efe2a8cf02fcc480455774174a0b477293f75b8713a62b571a3148b16008380a

Analysis

user interaction
yes
max time kernel
328s
max time network
325s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GreenLuma-Manager.exe
Size 18.0MB
Sample260828-vbddjszzfy
SHA256 efe2a8cf02fcc480455774174a0b477293f75b8713a62b571a3148b16008380a
MD5 3f6c43e5aab44610e60fdf1e490ed70e
SHA1 97f3934edbef2d063858b29723db51bbbc352f63
SHA512 9dd2cc658809ef19ffd4df8a88e5b95a7709b9c90f2143a427722372711900cef70b542dee62681c50963314973381b099e27ad3be051b346b3e3458265000fa
SSDEEP 98304:QB55rHI41Cu1yUIla5QbSw1//qS7enhj4HCf/IQLQ8QYxWCJ7XTlx7JOxK:QB55rFCIDIY5Qms/dehh9Q8QYvJOxK
TLSH
T10C1764AAD694092FE97F627CA1341322F121933722649D373B3CC85D2FB2B472585B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
116	1020	msedge.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.11-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.11-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	GreenLuma-Manager.exe

Executes dropped EXE 7 IoCs

pid	Process
5068	windowsdesktop-runtime-10.0.11-win-x64.exe
2440	wixstdba.exe
4776	windowsdesktop-runtime-10.0.11-win-x64.exe
1152	windowsdesktop-runtime-10.0.11-win-x64.exe
3216	windowsdesktop-runtime-10.0.11-win-x64.exe
6116	wixstdba.exe
4228	windowsdesktop-runtime-10.0.11-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
5320	MsiExec.exe
5320	MsiExec.exe
5808	MsiExec.exe
5808	MsiExec.exe
5208	MsiExec.exe
5208	MsiExec.exe
456	MsiExec.exe
456	MsiExec.exe
4276	MsiExec.exe
4276	MsiExec.exe
5808	MsiExec.exe
5808	MsiExec.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe
1780	GreenLuma-Manager.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{96749152-C361-49E0-BAC6-818F491B9276} = "\"C:\\ProgramData\\Package Cache\\{96749152-C361-49E0-BAC6-818F491B9276}\\windowsdesktop-runtime-10.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{96749152-C361-49E0-BAC6-818F491B9276} = "\"C:\\ProgramData\\Package Cache\\{96749152-C361-49E0-BAC6-818F491B9276}\\windowsdesktop-runtime-10.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.11-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GreenLuma-Manager.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\mscordbi.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\es\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1565706969\keys.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pl\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hant\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1726584908\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hant\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Security.Permissions.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB269.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID390.tmp	msiexec.exe
File created	C:\Windows\Installer\e588d2e.msi	msiexec.exe
File created	C:\Windows\Installer\e588d34.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0B4F3EF1-06F1-46E4-B662-A33DECC02141}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE20.tmp	msiexec.exe
File created	C:\Windows\Installer\e588d28.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA518.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{208D3FC0-B592-4221-8E53-6B21621E9951}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d34.msi	msiexec.exe
File created	C:\Windows\Installer\e588d3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI776.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7E8.tmp	msiexec.exe
File created	C:\Windows\Installer\e588d38.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d28.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E1510730-5A34-4EF3-B865-84351D8BF1BA}	msiexec.exe
File created	C:\Windows\Installer\e588d2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA680.tmp	msiexec.exe
File created	C:\Windows\Installer\e588d33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d39.msi	msiexec.exe
File created	C:\Windows\Installer\e588d39.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{042FE0BF-0E19-47E0-8864-22F483C784E6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI448.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA85.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8E.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324093422169589"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3D802295B1224E835B61226E19915	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.44.56884_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FB0EF24091E00E748846224F387C486E\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DE3412E2BCA54F551364F22502DDCA8B\FB0EF24091E00E748846224F387C486E	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\ProductName = "Microsoft .NET Host - 10.0.11 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.11 (x64)"	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\Version = "1345117748"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E1510730-5A34-4EF3-B865-84351D8BF1BA}v80.44.56884\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\SourceList\PackageName = "dotnet-hostfxr-10.0.11-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}\Version = "10.0.11.50000"	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.44.56884_x64\Dependents\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\SourceList\PackageName = "windowsdesktop-runtime-10.0.11-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64\Dependents	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\ProductName = "Microsoft .NET Runtime - 10.0.11 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0B4F3EF1-06F1-46E4-B662-A33DECC02141}v80.44.56884\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{042FE0BF-0E19-47E0-8864-22F483C784E6}v80.44.56884\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}\Dependents	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.44.56884_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93BFA97052F56B875A679F3A630341A6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DE3412E2BCA54F551364F22502DDCA8B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.44.56884_x64	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.44.56884_x64\Version = "80.44.56884"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64\ = "{042FE0BF-0E19-47E0-8864-22F483C784E6}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FB0EF24091E00E748846224F387C486E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\PackageCode = "76C6D03221F1CAF46826BB2A98EA4C8E"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{E1510730-5A34-4EF3-B865-84351D8BF1BA}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64\Dependents\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
5572	msedge.exe
5572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
5380	msedgewebview2.exe
5380	msedgewebview2.exe
3816	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSecurityPrivilege	4632	msiexec.exe
Token: SeCreateTokenPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeLockMemoryPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeMachineAccountPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeTcbPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSecurityPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeTakeOwnershipPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeLoadDriverPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSystemProfilePrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSystemtimePrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeProfSingleProcessPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeIncBasePriorityPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeCreatePagefilePrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeCreatePermanentPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeBackupPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeRestorePrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeShutdownPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeDebugPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeAuditPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeChangeNotifyPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeRemoteShutdownPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeUndockPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSyncAgentPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeEnableDelegationPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeManageVolumePrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeImpersonatePrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeCreateGlobalPrivilege	4776	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe
Token: SeRestorePrivilege	4632	msiexec.exe
Token: SeTakeOwnershipPrivilege	4632	msiexec.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
2440	wixstdba.exe
6116	wixstdba.exe
6116	wixstdba.exe
1780	GreenLuma-Manager.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3816	1936	GreenLuma-Manager.exe	91
PID 3816 wrote to memory of 2396	3816	msedge.exe	92
PID 3816 wrote to memory of 1020	3816	msedge.exe	93
PID 3816 wrote to memory of 2300	3816	msedge.exe	94
PID 3816 wrote to memory of 2300	3816	msedge.exe	94
PID 3816 wrote to memory of 2300	3816	msedge.exe	94
PID 3816 wrote to memory of 5020	3816	msedge.exe	95
PID 3816 wrote to memory of 5020	3816	msedge.exe	95
PID 3816 wrote to memory of 2020	3816	msedge.exe	96
PID 3816 wrote to memory of 2020	3816	msedge.exe	96
PID 3816 wrote to memory of 2020	3816	msedge.exe	96
PID 3816 wrote to memory of 2388	3816	msedge.exe	97
PID 3816 wrote to memory of 2388	3816	msedge.exe	97
PID 3816 wrote to memory of 2388	3816	msedge.exe	97
PID 3816 wrote to memory of 312	3816	msedge.exe	99
PID 3816 wrote to memory of 312	3816	msedge.exe	99
PID 3816 wrote to memory of 312	3816	msedge.exe	99
PID 3816 wrote to memory of 1348	3816	msedge.exe	100
PID 3816 wrote to memory of 1348	3816	msedge.exe	100
PID 3816 wrote to memory of 1348	3816	msedge.exe	100
PID 3816 wrote to memory of 4636	3816	msedge.exe	103
PID 3816 wrote to memory of 4636	3816	msedge.exe	103
PID 3816 wrote to memory of 4200	3816	msedge.exe	104
PID 3816 wrote to memory of 4200	3816	msedge.exe	104
PID 3816 wrote to memory of 2284	3816	msedge.exe	108
PID 3816 wrote to memory of 2284	3816	msedge.exe	108
PID 3816 wrote to memory of 920	3816	msedge.exe	109
PID 3816 wrote to memory of 920	3816	msedge.exe	109
PID 3816 wrote to memory of 4300	3816	msedge.exe	111
PID 3816 wrote to memory of 5068	3816	msedge.exe	112
PID 3816 wrote to memory of 5068	3816	msedge.exe	112
PID 3816 wrote to memory of 1848	3816	msedge.exe	113
PID 3816 wrote to memory of 1848	3816	msedge.exe	113
PID 3816 wrote to memory of 1848	3816	msedge.exe	113
PID 3816 wrote to memory of 3024	3816	msedge.exe	114
PID 3816 wrote to memory of 3024	3816	msedge.exe	114
PID 3816 wrote to memory of 4020	3816	msedge.exe	115
PID 3816 wrote to memory of 4020	3816	msedge.exe	115
PID 3816 wrote to memory of 2596	3816	msedge.exe	116
PID 3816 wrote to memory of 2596	3816	msedge.exe	116
PID 3816 wrote to memory of 4680	3816	msedge.exe	117
PID 3816 wrote to memory of 4680	3816	msedge.exe	117
PID 3816 wrote to memory of 4680	3816	msedge.exe	117
PID 3816 wrote to memory of 2952	3816	msedge.exe	118
PID 3816 wrote to memory of 5068	3816	msedge.exe	119
PID 5068 wrote to memory of 2440	5068	windowsdesktop-runtime-10.0.11-win-x64.exe	121
PID 5068 wrote to memory of 4776	5068	windowsdesktop-runtime-10.0.11-win-x64.exe	122
PID 1152 wrote to memory of 3216	1152	windowsdesktop-runtime-10.0.11-win-x64.exe	127
PID 4632 wrote to memory of 5320	4632	msiexec.exe	128
PID 3816 wrote to memory of 5400	3816	msedge.exe	129
PID 3816 wrote to memory of 5400	3816	msedge.exe	129
PID 3816 wrote to memory of 5452	3816	msedge.exe	130
PID 3816 wrote to memory of 5452	3816	msedge.exe	130
PID 4632 wrote to memory of 5808	4632	msiexec.exe	132
PID 3816 wrote to memory of 5928	3816	msedge.exe	133
PID 3816 wrote to memory of 5936	3816	msedge.exe	134
PID 3816 wrote to memory of 5944	3816	msedge.exe	135
PID 3216 wrote to memory of 6116	3216	windowsdesktop-runtime-10.0.11-win-x64.exe	136
PID 4632 wrote to memory of 5208	4632	msiexec.exe	137
PID 3216 wrote to memory of 4228	3216	windowsdesktop-runtime-10.0.11-win-x64.exe	138
PID 4632 wrote to memory of 456	4632	msiexec.exe	142
PID 4632 wrote to memory of 4276	4632	msiexec.exe	145
PID 4632 wrote to memory of 5808	4632	msiexec.exe	146
PID 3816 wrote to memory of 5856	3816	msedge.exe	147

C:\Users\Admin\AppData\Local\Temp\GreenLuma-Manager.exe
"C:\Users\Admin\AppData\Local\Temp\GreenLuma-Manager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffb0767c188,0x7ffb0767c194,0x7ffb0767c1a0
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,15850479872435062283,16371065640994463011,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,698904877506033780,16867765367716304708,262144 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,15403501817854655267,2359237299495547667,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,481199338204936759,4554939611050636545,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,16129381345946231415,718916290249082049,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,12950889005301357507,9530712134953457304,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7486104410683862927,1920615560666648787,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,8530783417224950340,11901884252814909008,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,2274162687800195323,4151964152763760541,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,14665561067029952984,11115741117584454942,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,1047538163236388007,1581333778056545102,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3352169120948620685,15633313623667276599,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3352169120948620685,15633313623667276599,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,7161335944025624479,533353843490546505,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6220,i,15146178742107618012,3610966459515342119,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,16520952941009705965,2014690088735117261,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5385779346646947422,17153297789934878554,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,10301021813434446806,9865804762220793036,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6076,i,10359758980320913451,3312529490962180888,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,1081816197888942977,9981138620647649722,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
    3⤵
    PID:2952
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{AB832221-FAD7-4013-B8A7-66089825B8DE} {E018DD5A-AD49-42EB-846C-5E4D9B5C849B}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2440
  - - C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.be\windowsdesktop-runtime-10.0.11-win-x64.exe
      "C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.be\windowsdesktop-runtime-10.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{29390F49-E4AF-4E40-92A3-691FE6704084} {BF4A3E10-0464-48A2-B7A7-092CF026B2AF} 5068
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18089948552098448172,12279197912832950946,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,13237652170252702746,8534087867553627170,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,1991054466982509250,8826237134155726892,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,13459029525489951964,2496571930289244178,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,2713405918655572198,5564001700536245621,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,13953544408991021323,7043995334891944607,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7694168405702481705,12433811221837686937,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,7879423991404043506,1526755525934998552,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,13256714042668982120,10443805805833109030,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7028,i,1327113350250604674,11668586949049954881,262144 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,16903195141500761536,10146735345428419008,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,16429986552547694746,102005261771816412,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,12505560939530526937,15594440076820690814,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,15928209159355643648,8185028195891416808,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,10133163284150142690,11744490558377290509,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,8589511978521680239,8977109152179287310,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,10150823030347339278,11598843215764801741,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,7838046386060933754,2036174016172937436,524288 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3672,i,10689770426392049419,4219906346009495537,2097152 --field-trial-handle=2304,i,9213240006468053793,12231241591325934891,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 93E6BC0F65FA234B94318E7AE201595C
  2⤵
  - Loads dropped DLL
  PID:5320
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CC850009A3871D13221455350D683F12
  2⤵
  - Loads dropped DLL
  PID:5808
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7EA72AFC817DC7E53DEC3E3DB96B2E2F
  2⤵
  - Loads dropped DLL
  PID:5208
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1F9950B6243218D8EF78356FD4A037FE
  2⤵
  - Loads dropped DLL
  PID:456
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C467F7F3A49BCE0EB4B535B5AF033CEA
  2⤵
  - Loads dropped DLL
  PID:4276
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4EDB62B69CC518835965D1B73D177C6B
  2⤵
  - Loads dropped DLL
  PID:5808

C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe
"C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe
  "C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\TEMP\{2EDC1BE0-14ED-4C1F-BE4E-0491DD1B938E}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{2EDC1BE0-14ED-4C1F-BE4E-0491DD1B938E}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C25E5BB7-82B7-4A1E-ACA3-5543DD1526C3} {58F5215F-6F7D-4D4D-8C00-844B5F0CEA2C}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:6116
- - C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe
    "C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{64DFD231-F343-4E98-B3F6-96A8D09A2D5E} {93459293-6482-4E31-AEB3-271625D50F5C} 3216
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\GreenLuma-Manager.exe
"C:\Users\Admin\AppData\Local\Temp\GreenLuma-Manager.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:1780
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=GreenLuma-Manager.exe --webview-exe-version=1.0.0-rc2.21+319b46eca7ef6c5e677bd93c2972c21e57fc5566 --user-data-dir="C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1780.1792.11473844717121986441
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x18c,0x7ffaf755b078,0x7ffaf755b084,0x7ffaf755b090
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView" --webview-exe-name=GreenLuma-Manager.exe --webview-exe-version=1.0.0-rc2.21+319b46eca7ef6c5e677bd93c2972c21e57fc5566 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,2771283505835054484,17479915310949224084,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView" --webview-exe-name=GreenLuma-Manager.exe --webview-exe-version=1.0.0-rc2.21+319b46eca7ef6c5e677bd93c2972c21e57fc5566 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2068,i,2771283505835054484,17479915310949224084,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView" --webview-exe-name=GreenLuma-Manager.exe --webview-exe-version=1.0.0-rc2.21+319b46eca7ef6c5e677bd93c2972c21e57fc5566 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2408,i,2771283505835054484,17479915310949224084,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView" --webview-exe-name=GreenLuma-Manager.exe --webview-exe-version=1.0.0-rc2.21+319b46eca7ef6c5e677bd93c2972c21e57fc5566 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,2771283505835054484,17479915310949224084,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView" --webview-exe-name=GreenLuma-Manager.exe --webview-exe-version=1.0.0-rc2.21+319b46eca7ef6c5e677bd93c2972c21e57fc5566 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3844,i,2771283505835054484,17479915310949224084,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/dev/apikey
  2⤵
  PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://steamcommunity.com/dev/apikey
    3⤵
    PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588d2b.rbs

Path C:\Config.Msi\e588d2b.rbs
Size 11KB
SHA256 5d05491618d7372457a051694da5556a9cc176571ad885316e59616944d6e20b
MD5 601a434b832d6dffe3ba51e552245bfc
SHA1 cd21dce19dd47dc343123f29c023541a6ebd2174
SHA512 abe162585feefbadfdfca4a8e37d9a666e28fe335a9c7fa6c8f5fa1a95c2bd3af162674513c71bbed624a7227139b102799ea298826348ebfd613e4e43ece36b
SSDEEP 192:0xvCC9Fb6t+5HLBW/efmxkI9xk/EEnRmCLupyL:0xvCC9FWt+5HF6xtxyb
TLSH
T1EC326183BA14C6E3E8D72734C7531B613BA2C7998724234B14CC96698F43BD45FBA2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d32.rbs

Path C:\Config.Msi\e588d32.rbs
Size 9KB
SHA256 371d0a9de4aa788c749e9f6421949fbf2295ae0077ec0ed61f1857c2863a0e05
MD5 d08482bffcf768beace8ac730f609b10
SHA1 78fc2ad6aacadc6920a26b203a15e89a45bcd545
SHA512 9c1540d54071c59b355195651eba1efbadb577b12d9a0d60bc7ddd0da501855ca03f840d155fb815f226326a1914b15bbbf6d6acc0691740fff35ded2dc8a4bb
SSDEEP 96:5mgPD3C/rs3ueWvfNU0WeD2SRCsTlYU0WeD2SRC6jliGnRTlOnNtE5P7pm/5VQqx:0kMbeqm0NkIN0NkkeEdAVrup7jK
TLSH
T14D121F02B740C2F2ED971B35C7A327B53BA7D3D99218635F08CD92605E47B891F642AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d37.rbs

Path C:\Config.Msi\e588d37.rbs
Size 49KB
SHA256 44b5408c3b7ed3c1f237f29beb51fa9ac28b24c450728d1ec3d068516cec5a97
MD5 23bf66cfdbae758cb57bb115c5b7810f
SHA1 fcd790f83e694e705087080aeaa1e1f6ea3d2360
SHA512 cabf81ebeeda8db808a6641ad0f5d3b289d33d4beb965bf7d50499da6f37afa15f6334f28e132bea34bc1b70c7e37ba893643c14a6c30847df9a0c33a34db577
SSDEEP 1536:JDADsBBFes69yTMH4b+k7TSROW5GIefFoTw7cfgvC00acxaJburYdBpJUGmCisfp:WO4zO
TLSH
T153332231BB88E1E3FB333D742322DC047B26CD56DA08949947C99576CE96AC8DF9C096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d3c.rbs

Path C:\Config.Msi\e588d3c.rbs
Size 71KB
SHA256 1317eaff62e6036ec77361eea291168efcaa871db30688bd172d3513faf2d20e
MD5 d708b9a0ad169db1a6c2dc772caa1acd
SHA1 b65b5e0a9a620d36e31004466fae288cd3d9c40f
SHA512 33f37f92f95cd23c02e3aecf0367d44079df8869e54fae95c3d4b3e594a7e145f2c62661b02cef03c994c548647ad834980d80afcf0626d366394c2d3f1b0b9c
SSDEEP 1536:imt6bF33Jl/g1pnw428wpLKx/lL7bNohLS66Ua4qh2AVdo4bri5BJcseKMPxLVfl:letJ30sJGxZtCeE8iqOk+SiIUQ
TLSH
T1A86333662B10C0D9BD3329968F3BEA459E074CA216844D3F01C56B39DEF7E8A5F6C1E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d40.rbs

Path C:\Config.Msi\e588d40.rbs
Size 3KB
SHA256 a533e257c3b9e9a8d5ca7f1fceea47f8ccfaa440f13d530c5a3fc26d12052bed
MD5 4798039cf890f562409f427a1f8b8cff
SHA1 85a454090031182587cdd49c4beb4ba81eda20a8
SHA512 c4f37b54e514025ed37f8d5c458e7f2fe1384bf2ea8cf1d9ba7cf194f2d5b0158f4eb069d6fe83ae9f913b9271c0786be7190a93cff213fc71ecbb59a464d28c
TLSH
T10771A813AA04E2D3DCA61B30CD1B1B513777D7EAC3294387058CE1708E9B7859FEA18A
MD5 SHA1 SHA512 TLSH

Submit Download

e588d43.rbs

Path C:\Config.Msi\e588d43.rbs
Size 3KB
SHA256 2f0a9b6e2994d9fa8e515004e466f05a0c4f672d6ab9f3d40ed8174a8a3c6e22
MD5 8a5b39524dc35d8e9fb2ede0e3e8c1c1
SHA1 efd8a6ff02613b1274a9b3015f40412bbdbd9dd3
SHA512 6a31dafd1458b6b301c2f989c2a7d70aa403f9261a633a63387e5df54a88d28c2e70557d4b5c8f2e4c1072ab646456126d912dca8f9315c73e67b549c8f67f2b
TLSH
T14F819D03AA00D6D3FDA75B31CD1B076137B7CADA8794434B05CC92B04E9BBC5DE99649
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1465966035\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1531518193\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1565706969\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1672317812\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1726584908\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_386679038\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_598510918\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_717565020\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 ab1b71fd3dd71062e074c9fab8312081a81b7f2b3e0327c48c4d249c8d1a3135
MD5 fce677b017799edcce6777162fb482a4
SHA1 91ead8264f578e76f910e5db41d0aab8681cb903
SHA512 54d7e79725fa56f301f49177d071390c1481fdbb4943123c81ba92ab4b32a9585fe315eb7241828e1178156ab909f100695fa51d8655fc0d06581116a4740304
SSDEEP 3072:9GgP19lIuvTSBbQ/En4SbDqIG//k7l55wKjvyN:9GelIubgbQuDvqI7t3s
TLSH
T1DCF3061AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.11 (x64).swidtag

Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.11 (x64).swidtag
Size 490B
SHA256 96f5a7c21ec425f1839963582b4f2cb05aafa83263b90dc1849b5837d65e39b9
MD5 bd686897e45bebd6e3453ff56d82e875
SHA1 49a0fdd71fa886aa30baf71bfe9e539241f80b76
SHA512 5e0913e39cda866db4ef3acbd99e207e8f95328b1bd69159560b56729b69674d778678cd8fb1e724329b14bf816dbad019ef10f44195c6015f0d6457332aa963
TLSH
T18CF09E86F5407B3246B21B14E65EA181E359B6C3CC8866C84D58D966019B9A54377910
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\state.rsm
Size 1KB
SHA256 1773ca8ea411155e7fb3bb905826f794cdcfe0978a0cde80740fdb663f43e77b
MD5 77d529a24bfe3a4f6332da48c6239fac
SHA1 2d256d0fb1e220aaaecd940b9a4e32de37ca3035
SHA512 590fb24e032ecc872c4a9233a16c9de60ae7a6bd43bf955826b5fc30c0d84729b1a5aefa396dd04b3bac0cd8b0179dc47dccc178167e9302382b1ad3fd2c0d2a
TLSH
T17421D1515BF6092CF3F6AB3469F96625443BBC121C20C16E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5d3ecd651af714f6106984e96beefab0526496b0c0d15d626fb05e25ef9c2bca
MD5 a24a41023a9e196f5ee8180525d8b461
SHA1 b124f922f09566809a02ec2afdd72c2e006326b7
SHA512 62852f87391015a7f97e7515bd068971a2ea36454ca808dc584341e15ebd3d7665eb2833824a6d28be0ef607e95d21c52fb815818cffb18849344b5feca4b06e
TLSH
T114D0121232420974C0306073010362080841C51B804580445D29B51E1E340900A02486
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 436a72d0005ffb72a346def5e92bdaef034bfc8ba428491c92e0ed6381ff8f7b
MD5 009ff71cef192ef255e23c404f6cd627
SHA1 fbac779aedc6e48f1adfda40a542500c1830bc59
SHA512 64f8572a4df7718954883a1bd7b83d56f5df13436e702d3a3b23ad15d3e82139021484410da889663e21333af4e0a5928d8d74e14e85c6bd247f768a2e6dad74
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d41daf8901ac91aa83824c851758a091bb0d8571b68e13d01e22c9e896d8d12e
MD5 653c3ab5f132c8aa4b2cbc580e3b8895
SHA1 8ec33dad9501073e9d1085aab612e5cf2ee6b9a8
SHA512 25f3396ac02b46cedeceea0aec6f6be22796a003c1c1d17e953b2273a3c866226a88a1ed856565acf99da169cc4b467e5fae467df2b321075f5b247a286b0a68
TLSH
T1A7A00229155F9001D14A0B716AD21A5173F54E1515420E2A50A1127499D07924296140
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Local State
Size 1KB
SHA256 5816a736df737021f8793ed1d7fc080e84f5cd2453948e3108551e1cadb391ab
MD5 6ace8d056e7f93a509ed1a08f63a07cf
SHA1 f04d96f6e75828320040f6edcd8858cddf8d8b6f
SHA512 63820d81d1999dd79e140b17dd8a53b40223748fba6ad2400edae9592e29671abae6736edf00b6ad78ff2f53439a66a5cb5c8f6446a1b3518ac99c0831d07ba3
TLSH
T148318773A0D47F32ADD2929BF1866B8B7D20215EC2119E44E1DD0B0C02D72CC593AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Local State
Size 2KB
SHA256 2790680b69e23d6fb7c035c64234b0875af6bed32f2000f504b107281f72bca6
MD5 87e3a73e0d04b24e4f6864a5af8057e3
SHA1 188d1b7e576509917444cc18e009add637685b80
SHA512 f551038a3d5545d56420a9de394d2c733d0cbca03a8ea2bbcd7b3105e061fd0d8ab36097bb7c96d208a758d58e05e1612d16fc9282847c6d1f9b3956917c94b4
TLSH
T17E51A773B888BB378AE38655F98A3F57AD3121A9D6512F50E5DC0B0C01DB29C2716C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Local State
Size 3KB
SHA256 a82c4a5818ab14ee1eaaf145c2745870759815dda56c2a4ce692afe99a90d60c
MD5 251f796182317df581a49aac61be2410
SHA1 27dcf6f9c40c79fa2496d24a2a57515d3979920b
SHA512 48a9ad2ba82118da2e437daf844fd6542bfac4e35e32c65d33f8d54a6b5aa26915e8c18aeba7a51dff141a9846a62919d251430be1198705d23c625db92d0782
TLSH
T15A717533A4A8FA374EE3DA45F9862B16BA61216BD5953F94D5EC0F0C02D738C1352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Local State
Size 4KB
SHA256 a89fc40ead6c7dd7225bdb0d276747c2879fe8b7b7ccfd8af3cfa95d7fb2d7cf
MD5 4b1993cc9c1cf225a599312081f684b9
SHA1 10ccd5f7355702346ddb9202e9e501e343bfc6f3
SHA512 551334e2a149bbfd19faf6ea986a6488e77fc76f3a99810f0a5b99f633a2e89bd1e5e9a9569a1d635b53d0439612c247eda44b3431ebf83c228ec46fa6585f34
SSDEEP 96:zuQF3NkCEsfDdVZv58Frh/cInURoDotoTFwZDVByZ16vWVZ41QTBl9a:zpF3NbjqooDU4uJryZ2b1oc
TLSH
T18691833364A4AA379DE3DA46B98A3B0BB6616167D1957F98D9EC0F0C02DB3CD1352C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5c1228.TMP

Path C:\Users\Admin\AppData\Local\GLM_Manager\WebView2\EBWebView\Local State~RFe5c1228.TMP
Size 1KB
SHA256 bbdeb61e3101188af6d4e679d62d88971403ff0e3ac11460c7b24c39f7aa498f
MD5 3f9b8f1888ff6a18fed2468155ccb177
SHA1 e32e3fba4d824de78a9574b1101d79177271dc1b
SHA512 839f971773041467e5e8c67ce9240000840dfd5722bc3f73c7e3ba07a59dc374c18d6f76bdc55af0cb9af4f9038c27ff1b65773b4ce5d215d577b3afb48f134d
TLSH
T17F214273D0D8AF76A991819AF186AB8B3D60216E92149E44E1DD060802D758C497BC32
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\GLM_Manager\config.json
Size 607B
SHA256 e2887d1790ce2dc88d350bc673fc961f208f2a934dbd9101c3acef593694af9c
MD5 0f3f827a4d680110bfd28146bdf62700
SHA1 3dd6e4000f725edd60442b9b5238597ce88de1bc
SHA512 14654c854739194514d98031f434a569a8fe310bae4f380b2f65e2f5a215ed8835d000ad9aa399f2eb66201efb6c7b748f784d3dcec557217f9f5d8c28b207fb
TLSH
T160F096315C00B0FE2A341A5CAC045F137B214F2525319D1BFEFB440CAA2AD353186FD6
MD5 SHA1 SHA512 TLSH

Submit Download

default.json

Path C:\Users\Admin\AppData\Local\GLM_Manager\profiles\default.json
Size 44B
SHA256 053cc4d448daf1c190337d3a047597d0e95cfa8666aed9d40feb398e7ac9d260
MD5 385b961700d6b5d729a6d0978b732ea8
SHA1 44c3ea7aec5baa277b5c2a8b18633c3232917a0f
SHA512 1def788ba11a512b397bb5ec53a18e647b2348d8ecc165885c13f77646a19fbb5822ab9489c61fccdfd28929915be331e04d962d55725395ff972df9a15478d2
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bcd71eed4df9f11eaf95b9a8cdad5673c57b3a30f10947ff5de4d7502fa900c1
MD5 ce85614d1a1c32916229fa1470fc91c1
SHA1 4ae5ede50c5368a890b6cc3ba6125c7810dec945
SHA512 3c56cec898811cce5da3cdb20912a623789df023152745a5dda7e5c46b1eb7e09d367bfe3fe82aab80bba85a6334823e06a970d740884886b711390a5e3841a6
TLSH
T133D02320B85CB8E0E23B003C0130D210B1CC0063F223920AF1100C0E9D3C44103F0AF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 208f8f8b8b6191549115c49de8187c86dbb96ef35614146a6a480c44bfadea2a
MD5 f107c60d49b4784b89eb0ff3fc53da12
SHA1 55b69ce30a214a124c9291e0ffa098c268447399
SHA512 ae3c6346108300a775d8e665114749b3ea51a071e5426e50cde1f0889b2e2f6fc5e10ed0c770ec6a86f7ab629cceb67d18fa00693b235c14f5837d7a53bb1746
SSDEEP 48:fUY9OgQ1WQSTMyVNbSOI9ntaK18CEovbJGJtB2lg7NV9lepd7lS2yqLK3PYeFU7u:fdiSYyVVAjVAlfJqpKZGBqm4B8V0Z
TLSH
T1A391F92402F1B55CC7281A3DF2D21A31713B818E491B6E5A1E907FFDE48A7B561D6D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ee594349c7d7b3898bc0ff3fb765af58ebaa39ca74e12946c435ca33cb3000c
MD5 4f14a6a1acdad6fee002d7ba90e0f0c3
SHA1 10a53918b56d52f1133029ec662bef75e4c7e918
SHA512 124e3fa5766566a352a1878cc169a36005c15202dbf61341ff35d8bc794e36cf6091a71692de450656ba4787c123489cd5527f9aedae9e8032fcc61a252c6751
TLSH
T14F711D3801A2D85CD368093DF2D11231B43F418E992B6E562E14BFFDE9CA77561DAD0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c0da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c0da.TMP
Size 3KB
SHA256 02da9d5fefbd015104ed2a57401f031012f3cb7339097e6005e3dbdb2b404361
MD5 c7d34f5364b5e954c8bb98119d28b77b
SHA1 212a5a1caf14c055940ea46889496ea28ac6e069
SHA512 a34ffe21625c42537b0d1ef348e88f0763d1d3e33e4b6f7d35d80991c74b38858c5461d636e1330e60aba44f238c6e1c752ab3a0c9637e59ecd0ebd84344cc38
TLSH
T120610B3802A2C84CD36C153DF1D11234743F868A9A1B6E662E14BFFDE5C9B31A1D6D0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 55c62c65f328cde2db516c461018eb146fb62b1452f6ddd76bf8681490db4a74
MD5 e1695a881eb8cce10c5748ab4d84d595
SHA1 6549bfa70d4ca7dfbc96e48c6de0346f16bf8bb1
SHA512 e2e716db84454a498204362d73f9659bdf5ccc45c5937dc56e8dec13a464bd391a623432103b34edb491d49a56a5cbf9b5c8cad21f25435d1674830c98c1775e
TLSH
T113618AF783A4856E8A1196F09A18EE2FDF2D0615431C3C6989D4EE27D3E3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 58f409188d68f6f9e7e2dc9eedbe6d9debde263f106b005038f7c18ab98b8e1a
MD5 4abe9e4265267ce40f594f8014157824
SHA1 915664e46c500cfc6b6ed06c1dc8eeb434cc2404
SHA512 cde9a89afd2c2daf6707367272efcc1c898eb254870b1d03b9253eb5234f7db0ab71606e332a922b94b1ec620c4db26e405522b28606809156331f6ebde99562
TLSH
T1C2818BF783B4856ECA1196F09A18AE2FDF2D0611435C7CA9C9D4AE2793F3471E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 83ad2543e0c3125e6e49bad3bb743cce632270660bc032ecbf8673d9ffe2a97a
MD5 7c7b07db533b27c205a72a5a04e7ff51
SHA1 49fb3b3a2efaf040fea920672297c8e2837896e0
SHA512 6748956e0ad25b2db80bfc7aad80e4a51c5be26f1620b6c4e75cbc405bd53f7870ba9ad1937bd503ce7cdfc6320c3df5c152783418e66e5a92fbaeba0caaf988
SSDEEP 192:sxZVzRzyM/jK1Ml8Mzn/fXsg6sS5Idpw9HW6+WNrcF/AsHBzKrIg4J:sxZVzrLn/fXsg6JSIHb8/oc
TLSH
T15F52D716AA34A977CCCBD209F9457B53D6F51563A2900E44AAFCCA1C01E7BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0667c9ec33aacf0b2900a960c7853df09ec972169bbac079d8fec0e2abc312b6
MD5 3c6a3da9407933de5c7e1140c135d812
SHA1 f10a966d97f5597b686820e33469af7cbfba7802
SHA512 1c655dcbfb5bbb9a32741df62ef792b27a206390f834edd55c5f515e77dfb3c1969e0b943ae6929bdbae434b0c3276d3916845b3c5e9fcb76286ae5c33046f15
SSDEEP 192:sxZVzRzyM/jK1Ml8UQ4mn/fXsEysZ2qPIdp69HW6+WNrnEXAsHdUvt3drIg5UJ:sxZVzrqln/fXsEySOOHbwXNUvXm
TLSH
T15362E816AA345977CCCBD209F945BB53E6F50576A2900E44AAFCCA1C01E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 57e87d16f13da199520cdbd67e95ce6b4c4782894fdbc751778e1e438ed12367
MD5 fc0823c0f90a5a1d5b97651d48aa16c4
SHA1 e279643d2e10c3df4ac0d705b1973aa01ef6f862
SHA512 d988cf73dba0127611e3825a6170b7574f7156d54f50c62e8b41819047769cac61bd8244feb5ab1e0fa5367b275e297c6b1eacb185ac7e07891e92b823685d53
SSDEEP 192:sxZVzRzyM/jK1Ml8Mmn/fXsE6sS5Idpw9HW6+WNrcF/AsHBzKrIg5iJ:sxZVzrun/fXsE6JSIHb8/oo
TLSH
T1EB52F816AA34A977CCCBD209F9457B53D6F50572A2901E44AAFCCA1C01E7BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d7a6b48ce416ca90bb3a047d72085d56d28e8673b0b625dd497361d6f39d5d67
MD5 5c18d9a1dfe324b9f2f476cc5d9ddcf1
SHA1 a7b8866800212ffa7e0f3bdaa423e5ca6fac0cff
SHA512 cced09b40e77a6ff3f5979b4f6d9563aba09e99aea411af6ebd303189209e9e5f120003fd322fcb91b2609d79b96f134d816df04cb62c6ada681417e2a0e8b85
SSDEEP 384:sxZVzlq8n/fXs9WvzySYvHbfomUUy+/pUvOE:s908n/f+YzyjHbfomUfEI
TLSH
T15F72D512A9345977CCDBD209F945BF63E6F41576A2900E44AAFC8A1C01E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 5fef6675fab2bb30a594355b731040a01b260c759703495f0a9b14e3f7a81275
MD5 b7690b74627def65efb67a560b3cae18
SHA1 c922709dfc340d9b535f76bb86f84b911928b855
SHA512 b7a724515ebdb1f6ec7b43195e1daea10360211afa66aa43f6ccd187379a008bde2050c5cbe4304fc5d2a776d0f1506d3eb7da7909d2e3fb9ca0a4147e538170
SSDEEP 768:5AUZYYj7pLuLzgMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RiroVK0:5AUZYYVEzgMWvg0Pou1ja7eLZmR5+Q
TLSH
T14AF2FB3B7C0CCB7E4F844E9DED2A6E8A6DD802CB5A988D5447EA844C03C76EF11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e89c097c5b07a52543cd133600c9e8cf132931ff772dc860d974c9db498ffa74
MD5 1a6e39134413cb5b87fdd78b9d111ca2
SHA1 af3cfcbec60cab687a8c5e38b5f718eeaa6b83ae
SHA512 d3018283e011af324e275f21acf982989035d32198c64b752177fbe33cfcf6190f96a4c2a1069975caf3bf52ad1cde2d8a32b83eb10a77dfb9dcc41d6ef555e4
SSDEEP 96:KA1eK2AAv+KAgmiSgKXq8OgKXqSeGbg0GwQxFU1sDsxKr4DmxH+2Nssz:EU1HQHeGbg0GwQHU1gsK4Dm9+2NsE
TLSH
T164E1076271BB02422D3E6B5893D4871BCE4272633058E52F3BAC01B18D67D629CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d0aac70-173a-42f5-94e8-861b57cd5e39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8d0aac70-173a-42f5-94e8-861b57cd5e39.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f22626daea74e87c6aa34cf0314fae56184bcc7f73a01051108342fae4ead360
MD5 3e63f23fae64c7deb934f7add3853c90
SHA1 a320ddba730539d319677237091320d2b5811960
SHA512 c06788d3aad881ff8bd30d1c05de5fce78bbc420b725e8ddeaba1953c7ab0a6a865b00e31bee5102cbd5aea0ce5681d587fe834cd2d8367609e75c52368f5df0
SSDEEP 384:nuZcIhsNZsqgp6SmL7zX5od+hO/VuXd+2Ic0X1puLfQtoN:MhEfOgO9utlIcsyLfQt2
TLSH
T139827D7169389C7394F6E145F58B36578FB850B7D5886F80E2E8AB1C0196A9C2B0FC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 3ccad94ddf1d73bcd4f86bb13d32a747f0aa2e20e17220c933d00eaf5619bdb8
MD5 bc9e9aadbb2c5c261ad55c0fe6f8a7e6
SHA1 712063ed37b6d2c78014f7bb1a74cb3b10b47669
SHA512 1ff4b365473d38eac02dec69eb9a2b65fc14e529bbe534a0bd18fabb8f09898dc6c2e5fb246e40d04c52f4101667703778f4b922ab51435507c1a571a78c1024
SSDEEP 384:nTiFeZcIdsN78TUNTUlIlbqgp6Em872DfY6X5od+hO/VuXd+2ic0X1puLfQtoN:+FcdiwgLxiOgO9utlicsyLfQt2
TLSH
T198D2A5F198D78936E8AE9383A77E7D468EBCC063B5885980B7945D0CCC825BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2cdc6886bcaf6a3d794ea1f72ac386f6112f34acf129e68ff6605076d90e5cde
MD5 1bd464c3f938eb356c6fa05fcb369784
SHA1 e82c92e8143b32336ee676fd86efc2db83faf269
SHA512 c7ddffb60d4247c94902812b4b567edb3b23d6021286a13c221e22bb02375e3dcc0e5ecb73c39c75513dbb40de4b62c5848259e57fb87767f5083f5489cd5fb3
SSDEEP 384:nuZcIvsNZsqgp6EmL7zX5od+hO/VuXd+2Ic0X1puLfQtoN:MvKfOgO9utlIcsyLfQt2
TLSH
T15A827E7169389C3394F6E145F58B36578FB850B7D5886F80E2E8AB1C0196A9C2B0FC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d75fd0def2e10c4a629a563431d9bab8ed8a34222bfcbcaf2f439c61628a3275
MD5 c8225fb9962cdd34a44e93dc8d3e9ba5
SHA1 4a016f1f7fd65415f563cfc1bc94d70227736936
SHA512 16bb66c07a9f2b47f045b66a145fb76e00f851ead2060aaf0a002b400add6959371fdb13d4e4b5f5549d6b45bb324246b9e55b71df59a216a5c8aa95d2c1e141
SSDEEP 768:+FAff7wgi8xiOgO9utloetSbLoKJKpXsyLfQt2:5ffrAYLoK8pX9It2
TLSH
T126F2A2F184D78DB6D4AD87C7972EAD0659BCC133B1485988B3E8292CEC9B4BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 2015ab967cd3863956983f3bbfd9199debc6b9cfa0dffee9f7cee18969e40edf
MD5 d86e63359c49804df9956b7b00fb2311
SHA1 46dc731d63cdbbc3a35911c73297ea5d5af01e2a
SHA512 fb8450357e06bef9a39a08bfadd639726128f456721f8be58ce6eb49839ec62d6fdda21a3bbdb9c034215c679f19f45ac27397e0c5a551a996248f9dbc8fd373
SSDEEP 384:nTiFtZcIhsN78TUNTUlIlbqgp6Hm872Dfp6X5od+hO/VuXd+2zc0X1puLfQtoN:+F1hiwgM0iOgO9utlzcsyLfQt2
TLSH
T1CCD2A4F198D78936E8AE9383A77E7D468EBCC063B5885980F7945D0CCC825BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ea086f4f6c34cc77778c5b208d84636fd34237e6d53086b5445eb708ca9ce538
MD5 098ddfc7a921dd1a7ed426c3965fe312
SHA1 d6825f6a18a5c8b23c168fe5146e37b13606224d
SHA512 7dc4f983e257bb79f1593e33533191d55b3d366c23623c7b8ac3d13d5433b23390713618f6e3c8f618f93e3366a5b3394ca6182c0ec8668a6280a4b4a34a0264
SSDEEP 384:ncZcIvsNZbqgp6EmL7zX5od+hO/VuXd+2Ic0X1puLfQtoN:KvhfOgO9utlIcsyLfQt2
TLSH
T14F927E7169399C3394F6E145F58B36578FB850B7D5886F80E2ECAB1C0196A9C2B0FC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 eb49dad47a50fbb5e845586d8a4862c4bf20d50f6c013c71f437cc38ae8beee2
MD5 7cdd26f7efe39fe75b3d03ec769b2668
SHA1 8c05bdf2dbd95b17afdbc36fbdd365060a2159c8
SHA512 9f3d14d914a551a940320f570bc8b6dcfaf3f143780710736fac5f0d29453fbe9e01c7bbe2a983a14635b7d71914272718b79b9a6d97b2e446312cdb39dbf11d
SSDEEP 384:nTiFPZcIhsN48TUNTUlIlbqgp6vm872Ufp6X5od+hO/VuXd+2Bc0X1puLfQtoN:+FHhTwgA1iOgO9utlBcsyLfQt2
TLSH
T182D2B4F198D78936E8AE9383A77E7D468EBCC063B5885980F7945D0CCC825BFD70A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 275c8daeba94bad799e91770e9046584238a9807650da7d061470d77a63ad5ab
MD5 623ea71d4e049109d72f873ab9cb18a8
SHA1 64caa3428b2a45b047f3c91c0be0959d7b2c1064
SHA512 44b38dd7b8ec8ab8a7426857ba1eb00207afbe008ffa3c592124b21c65ad218c261340cb59d77eed6466b5b0c3a0a9ada7ad88de85f1f1b7a20c045704b9cb46
SSDEEP 192:yONw61VWQmiUyvagGX5Obd+jFO/aob/ag36iU6:yONw6W7gGX5od+hO/V+hiU6
TLSH
T11402E93569286C778EF2BE49F48737135F9921ABEA542F84D6E81B1C00D769C2307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 1b11b23513dd55060832a7ee80c2f54eb0e77dd0f529829dd8284b1ecbfc8f3e
MD5 20083c7ecc73bdda8be394022c7092d1
SHA1 85e74f99f31a5363d15b246d90a9434ef81f7de1
SHA512 4ccb9b81b0826ec6321d2198b89c0590826a3a7079c7dc8c106d339cc55e800f1dbcef715448d860a90c6377941aeb7f341d97a68e7afb48f900efcf98972611
SSDEEP 384:nTiFKZcIffsN48TUNTUlIlbqgp6vmO72ffp6X5od+hO/VuXd+2Bc0X1puLfQtoN:+FoffTwgKkiOgO9utlBcsyLfQt2
TLSH
T163D2B4F198D78936E8AE9783A77E7D468EBCC06374885980F7945D0CCC825BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae27ca57e643cdb9c685a4b7b09bb656f1e0dfa2328b2c48d5ee88a3864752a8
MD5 77781d8f55433c2c0c96d08f8261fa56
SHA1 f2872e2aae63cfc909f950f5c51c6ab6a9801069
SHA512 0ee45ed05c4fb0089d784916c7bf18b3419a2898f24d7e5cb85e5c54793676aa87973586d7408bd12552aa76c84b442965947fa69e32cfe629140e3ba28ccab8
SSDEEP 192:vONc616WQmiUyu8aZGX5Obd+jFO/aouJFd+20jJmqipU6:vONc6D5FZGX5od+hO/VuXd+2scU6
TLSH
T15612F935A429EC239DE6B555F48732939F9920BBD9456F80E2E81B1C0097B9C3B4FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

1d98b2c9-0b32-4501-b5ec-b3dde1e70b54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d98b2c9-0b32-4501-b5ec-b3dde1e70b54.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 30020a1e25b02c46ce678ffc07e1d8c6e34f1fbe3170f0d356868193b91d716f
MD5 14e8c00e5a7d086c352bf9e10c37f988
SHA1 11f0a7bb36f10be6db519bd3868afcfb7b05bca6
SHA512 ec51598ab1e1281fcc1f1735fefd4304c986a51f93edae9025e31789ece6dcadce93da64b712ddecd08182ab63b5dd6a629c60dab535be421ce22264aaad74e1
TLSH
T136413AA8A6FE1158B3736F5AABF2A96D447FBD773E06D49D00110D4E0A22B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

2875591d-1a79-4df2-914b-90c73582c543.tmp

Path C:\Users\Admin\AppData\Local\Temp\2875591d-1a79-4df2-914b-90c73582c543.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8820de78-8f9c-49ef-a5fd-5ca1ae5db1da.tmp

Path C:\Users\Admin\AppData\Local\Temp\8820de78-8f9c-49ef-a5fd-5ca1ae5db1da.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916_000_DotNetHost.log
Size 3KB
SHA256 0d056377e1cfeea023107aa3e9ff886f3b54e37f6e7e92dcbb89941a2e21a6c0
MD5 a94b6b0fcadb0bd166b727b04eacfb3c
SHA1 8ae30ad45fc2ef13fcc5bc2eab8ee217c9449bec
SHA512 4858fdcb53a46ddec594776ca1dd792825e657d444763261330517bb02917d772881b3d7af1714500acdf970dfe640cfce418d6879802da74cdd91f571e9befc
TLSH
T14F81DB291EE50815F2B75707DFF384125A33BCC6A934CF4D23C84359065B906A9ACBAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916_001_DotNetHostFxr.log
Size 2KB
SHA256 68e9dae7aa0b3b96035339d6f633cb4a88e3be7229bb6853223ebb6f409530b5
MD5 f3b6f3cc1b21626d71c6277424153a12
SHA1 bf116e808b505d067f567348de9eb05a3d87cf76
SHA512 d2dc92426cac1ecbf9fad0312cc5dcd3f25023466e6b689a617ea95e446d25e2282a516f668877be6fda31173ec04e29bc592cab37386866f77e3eb18ec27afe
TLSH
T1A441B9691ED50919F2B35747DFB3C0512A33FCD96834CB4C13C8825A46ABD05FDA8BAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260828174916_002_DotNetRuntime.log
Size 2KB
SHA256 9a964477b4a977b571393d1a04c2282d89329a4794d9238d66dbc47f71d0f990
MD5 6907847f8175ba2ed76656678f0b107c
SHA1 6e3ab024862cb399dea5ae90699839d01637211e
SHA512 31e3d9c012ed165e902641a6f0707d3114b7e0ead9c29b2e6dcad61d06d6a967d0d5a4e68d3c5beae0c15688908b34d772ff2fbb381c3e1a39a7cda110ffe4fc
TLSH
T13241E5651AE50819B1F35747EFF3C4521A33FCD76934CF4C22884359066BD02ADACBAA
MD5 SHA1 SHA512 TLSH

Submit Download

9e1ca705-f376-4748-84f3-a717d3090bbc.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3816_1690260774\9e1ca705-f376-4748-84f3-a717d3090bbc.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3816_63336693\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\DotNetHost
Size 848KB
SHA256 9b5a284ef59186a406f17adba632320c9445283df25fc1d8c91e6cf9c0aebba6
MD5 6d87594596de8309932f98f4a86e0017
SHA1 e94732591daeae78ab4b7f1ba9ddf96400546b9b
SHA512 f4af95ad47758ef6705ebbe7bb1ac5299a0bed6536ff3ee83012c95a39240e59ce894e9cbfe6fe880ae828155722bcf2c2b0986d4a376ae97ba55e7e92e87974
SSDEEP 12288:8BGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYENSpP:8GyASwoO2T7RgZMYdt
TLSH
T193055A1BBF9414A9D8A24EB1C4B78321FE357C082320959F46A4B12DDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\DotNetHostFxr
Size 920KB
SHA256 f60018bbec2596c180a88e7a0b6ae8e752c415b2fc049c71225d8b2ce00fffb2
MD5 19c12802f60178f3e5cc48286bf98110
SHA1 36c25d8955ea50a5dae9bbc72b4acffe813bc9c1
SHA512 fedd407c5d30dd5156f70eac83bf3b9c74e33f7fbecde5396c1c3ba7026d4c0aea2cd61e8d937b7621c3e6778ac406010d45784e67c0d6de06ca8d07218b80b3
SSDEEP 12288:nBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYeU2Lpj1HdyVFIG:BGyASwoO2T7RgZMYeZpja3IG
TLSH
T129156B2B7F9004A9D8A24EB1C5B78321EE357C082720959F46A4B12DDFFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\DotNetRuntime
Size 28.0MB
SHA256 e82639829de6ee49da7b508ad629a747ec3a86b2ffab20f0f9983740644f32d3
MD5 a8dc7f3ac09e8736d0e57c4d47cd6d9c
SHA1 371115f7ee565dc16e4c4f721b80823fe1f45ddd
SHA512 47d78d3f510be0af5406e6c2c067138357a76645295fd6509af24e29ebcf769ce9f71214c2b2cafb14e8239a4e33878951f93faf3e13ea2fec826f358b63e10e
SSDEEP 786432:ORXHSvEHL1IPHptj74pZ2Mb3TJVQAWkBZ5TPMH:yXHjr1WHptIpZ2W96M7TE
TLSH
T10A5733277FE205FDD4268DB089B78770AE767C082721895B0664722DEEFB2E014B63D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1c772b974296393af3299b3f7151a5f12b5bc6fe424740b56546694da98dc0ec
MD5 90bfd4b0e9f0a95fdda8f1b18a0ec66b
SHA1 50956cccfcdceba02d597cb4a3ff2f9561d4735f
SHA512 1a1f437d1f372896fa2d66b19e2ac425701202bc1577f18aa6b689bda11c02174c1bac3bc385dcb017b437881b9ad5006a8c69479c6a89c23f4f7a94da418f9d
SSDEEP 786432:9VaZwvdvm6W4YrGj9Eq0i9h5bXAUc4e3cPhoZV:9V2r4VG5iFDAD4eM5o/
TLSH
T1A367335B7FE218AAE9620D70C1B74324EA72BC182351856F5320721DDEFB3E0A57A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI93B0.tmp

Path C:\Windows\Installer\MSI93B0.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 ea4712ff76997fee669ac541f82d0701471eb301495fde62e50dba3b418b98b4
MD5 8a2948efbb7ec8a1b544086aead7b4e0
SHA1 57643916e9635753db4c06e09a3bcb1f2eaba339
SHA512 8c36ec4b1d9480b4e2303845fe9fa524ada14e2e53727f5bf8825efb81324a7efb2097b971e138709085c0a87dc3caea0b1f0812d9193511845d17ad67e09801
SSDEEP 192:B8zanZTsX/rv9RNnEXenqlaTaJjfAmcsCsysz:HnJusCsysz
TLSH
T15712E2113BFD0218F0F3AF48EFF6A5555A3ABD552E39C92D01201D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.11-win-x64.exe

Path C:\Windows\Temp\{DD338F5D-74BB-42E9-A702-2DAB361A2734}\.be\windowsdesktop-runtime-10.0.11-win-x64.exe
Size 968KB
SHA256 1950ffbecb490c67326b9301c212ce4c0bbcdb9fbb883d1d855ee11f1f866739
MD5 e884480fadaeed6e10810ef7c8854bfa
SHA1 4510ae5b7b0fbc0e1f4b70a64f834dba1cd820c9
SHA512 bddbf08bfb3b608f4218b41676c6b8c67f28b7b4449696c5146fd12b9e7a9cde4657ee344fb998b0dbbd14a8a19f4b795dfbb368ed9799b953b18ae2b34d4100
SSDEEP 12288:j/hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xnawDmIRn1NnKQi2ejDkS:jZzPRq5eZbpTh47zykJawFRHKmKk
TLSH
T1A1256C31A566241BE6F40973F914D6307E28E7082B5C85B6C6D0DC0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3404-1788-0x00007FFB22A00000-0x00007FFB22A01000-memory.dmp

Download

memory/4632-1317-0x000001ED85640000-0x000001ED86101000-memory.dmp

Download

memory/4632-974-0x000001ED85640000-0x000001ED86101000-memory.dmp

Download

memory/4632-744-0x000001ED85640000-0x000001ED86101000-memory.dmp

Download

memory/5740-1687-0x00007FFB22A00000-0x00007FFB22A01000-memory.dmp

Download

memory/5988-1762-0x00007FFB233C0000-0x00007FFB233C1000-memory.dmp

Download

memory/5988-1761-0x00007FFB240B0000-0x00007FFB240B1000-memory.dmp

Download