hxxps://github[.]com/Ixars/ransomdoors/releases

Analysis

user interaction
yes
max time kernel
899s
max time network
499s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Ixars/ransomdoors/releases
Sample260910-vbp3casfja

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
84	2940	msedge.exe
191	2940	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.12-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.12-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
4280	rans0m.exe
5644	windowsdesktop-runtime-10.0.12-win-x64.exe
5100	wixstdba.exe
3972	windowsdesktop-runtime-10.0.12-win-x64.exe
5344	windowsdesktop-runtime-10.0.12-win-x64.exe
3980	windowsdesktop-runtime-10.0.12-win-x64.exe
5188	wixstdba.exe
5464	windowsdesktop-runtime-10.0.12-win-x64.exe
4204	rans0m.exe

Loads dropped DLL 64 IoCs

pid	Process
4248	MsiExec.exe
4248	MsiExec.exe
5704	MsiExec.exe
5704	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5604	MsiExec.exe
5604	MsiExec.exe
3424	MsiExec.exe
3424	MsiExec.exe
5624	MsiExec.exe
5624	MsiExec.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe
4204	rans0m.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Private.Windows.GdiPlus.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFDD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF21.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aa142.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E358F0F7-0226-419D-85E6-D45A08BF195F}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aa14e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aa149.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB366.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB58B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aa142.msi	msiexec.exe
File created	C:\Windows\Installer\e5aa14d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B7.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA8D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{902710DF-F5E0-42EB-8959-ECC10CC368DF}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB471.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID27D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID637.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e5aa148.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB123.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aa149.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA356.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID03A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aa153.msi	msiexec.exe
File created	C:\Windows\Installer\e5aa157.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aa14e.msi	msiexec.exe
File created	C:\Windows\Installer\e5aa152.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aa153.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0E7.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335325610347612"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{902710DF-F5E0-42EB-8959-ECC10CC368DF}v80.48.58476\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.gold1\ = "GoldFile1"	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\GoldFile2	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.48.58476"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Version = "1345381484"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.gold3\ = "GoldFile3"	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.gold6	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.gold1	rans0m.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\GoldFile1	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\GoldFile5\DefaultIcon	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\GoldFile6\DefaultIcon	rans0m.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{E358F0F7-0226-419D-85E6-D45A08BF195F}v80.48.58476\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.gold5	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\PackageCode = "F51312C54E22CEC4182D8D57784720B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Version = "1345381484"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\PackageCode = "1996005C24BB6ED459236374EB503368"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.crucifix\ = "CrucifixFile"	rans0m.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{87345D43-9D18-4D17-9F16-CF6D2A2CB61E}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\ = "{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\PackageName = "windowsdesktop-runtime-10.0.12-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\GoldFile2\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\RANSOM\\Icons\\gold2.ico"	rans0m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\GoldFile3\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\RANSOM\\Icons\\gold3.ico"	rans0m.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566\MainFeature	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5932	msedge.exe
5932	msedge.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
1004	msiexec.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5052	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	1004	msiexec.exe
Token: SeCreateTokenPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLockMemoryPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeMachineAccountPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTcbPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTakeOwnershipPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLoadDriverPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemProfilePrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemtimePrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeProfSingleProcessPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncBasePriorityPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePagefilePrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePermanentPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeBackupPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeShutdownPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeDebugPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAuditPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeChangeNotifyPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRemoteShutdownPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeUndockPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSyncAgentPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeEnableDelegationPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeManageVolumePrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeImpersonatePrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreateGlobalPrivilege	3972	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe
Token: SeRestorePrivilege	1004	msiexec.exe
Token: SeTakeOwnershipPrivilege	1004	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
4204	rans0m.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe
5052	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4204	rans0m.exe
4204	rans0m.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1904	2572	msedge.exe	86
PID 2572 wrote to memory of 2940	2572	msedge.exe	87
PID 2572 wrote to memory of 4836	2572	msedge.exe	88
PID 2572 wrote to memory of 4836	2572	msedge.exe	88
PID 2572 wrote to memory of 4836	2572	msedge.exe	88
PID 2572 wrote to memory of 4300	2572	msedge.exe	90
PID 2572 wrote to memory of 4300	2572	msedge.exe	90
PID 2572 wrote to memory of 3208	2572	msedge.exe	91
PID 2572 wrote to memory of 3208	2572	msedge.exe	91
PID 2572 wrote to memory of 3208	2572	msedge.exe	91
PID 2572 wrote to memory of 856	2572	msedge.exe	92
PID 2572 wrote to memory of 856	2572	msedge.exe	92
PID 2572 wrote to memory of 856	2572	msedge.exe	92
PID 2572 wrote to memory of 2636	2572	msedge.exe	93
PID 2572 wrote to memory of 2636	2572	msedge.exe	93
PID 2572 wrote to memory of 2636	2572	msedge.exe	93
PID 2572 wrote to memory of 1444	2572	msedge.exe	94
PID 2572 wrote to memory of 1444	2572	msedge.exe	94
PID 2572 wrote to memory of 1444	2572	msedge.exe	94
PID 2572 wrote to memory of 3424	2572	msedge.exe	99
PID 2572 wrote to memory of 4176	2572	msedge.exe	98
PID 2572 wrote to memory of 3424	2572	msedge.exe	99
PID 2572 wrote to memory of 4176	2572	msedge.exe	98
PID 2572 wrote to memory of 2856	2572	msedge.exe	101
PID 2572 wrote to memory of 4248	2572	msedge.exe	104
PID 2572 wrote to memory of 4248	2572	msedge.exe	104
PID 2572 wrote to memory of 2532	2572	msedge.exe	103
PID 2572 wrote to memory of 4248	2572	msedge.exe	104
PID 2572 wrote to memory of 2532	2572	msedge.exe	103
PID 2572 wrote to memory of 2696	2572	msedge.exe	105
PID 2572 wrote to memory of 2636	2572	msedge.exe	111
PID 2572 wrote to memory of 1100	2572	msedge.exe	112
PID 2572 wrote to memory of 5008	2572	msedge.exe	113
PID 5360 wrote to memory of 5440	5360	msedge.exe	126
PID 2572 wrote to memory of 5812	2572	msedge.exe	127
PID 2572 wrote to memory of 5812	2572	msedge.exe	127
PID 2572 wrote to memory of 5868	2572	msedge.exe	131
PID 2572 wrote to memory of 5868	2572	msedge.exe	131
PID 2572 wrote to memory of 5868	2572	msedge.exe	131
PID 2572 wrote to memory of 5932	2572	msedge.exe	132
PID 2572 wrote to memory of 5992	2572	msedge.exe	133
PID 2572 wrote to memory of 4280	2572	msedge.exe	134
PID 4280 wrote to memory of 3860	4280	rans0m.exe	135
PID 3860 wrote to memory of 3464	3860	msedge.exe	136
PID 2572 wrote to memory of 2216	2572	msedge.exe	137
PID 2572 wrote to memory of 2216	2572	msedge.exe	137
PID 2572 wrote to memory of 2216	2572	msedge.exe	137
PID 2572 wrote to memory of 4020	2572	msedge.exe	138
PID 2572 wrote to memory of 4020	2572	msedge.exe	138
PID 2572 wrote to memory of 4020	2572	msedge.exe	138
PID 2572 wrote to memory of 2900	2572	msedge.exe	139
PID 2572 wrote to memory of 2900	2572	msedge.exe	139
PID 2572 wrote to memory of 2900	2572	msedge.exe	139
PID 2572 wrote to memory of 5244	2572	msedge.exe	140
PID 2572 wrote to memory of 5644	2572	msedge.exe	141
PID 5644 wrote to memory of 5100	5644	windowsdesktop-runtime-10.0.12-win-x64.exe	142
PID 5644 wrote to memory of 3972	5644	windowsdesktop-runtime-10.0.12-win-x64.exe	143
PID 5344 wrote to memory of 3980	5344	windowsdesktop-runtime-10.0.12-win-x64.exe	147
PID 1004 wrote to memory of 4248	1004	msiexec.exe	148
PID 1004 wrote to memory of 5704	1004	msiexec.exe	149
PID 1004 wrote to memory of 5996	1004	msiexec.exe	150
PID 3980 wrote to memory of 5188	3980	windowsdesktop-runtime-10.0.12-win-x64.exe	151
PID 1004 wrote to memory of 5604	1004	msiexec.exe	152
PID 3980 wrote to memory of 5464	3980	windowsdesktop-runtime-10.0.12-win-x64.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Ixars/ransomdoors/releases
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdc880c188,0x7ffdc880c194,0x7ffdc880c1a0
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,9803886413565057406,13470061730815808487,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2522132440442637751,15753221592755244870,262144 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,12752188188393278478,3168772997001805281,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12265766375163893176,4224497452906641172,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9776260673184515883,14006842485424514176,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5315042151944511485,8526097695906918849,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,12055576024967139741,17920556772086595906,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,5258738632864795377,18119145613815994991,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,13900233788041569735,9872450800494410810,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,9735160412889176023,11989650386578664828,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,9735160412889176023,11989650386578664828,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,12546094315617247260,12511735111433659846,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6228,i,6541558335858812990,6781753086124875308,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,15581341936323519601,4043314499152063145,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,12251254517734129752,1894927510099210103,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,6201848506815708785,6834192189582586007,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,738807363705509983,15038605566648101184,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,5717643747487092597,11119403157577388822,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4336,i,9817790232047807451,1619973104316116232,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4232,i,6234451488081954564,17544274419792167305,262144 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,16405726057409499848,17727057605299176149,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:5992
- C:\Users\Admin\Downloads\rans0m.exe
  "C:\Users\Admin\Downloads\rans0m.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
      4⤵
      PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6392,i,1890502013164127094,3354470710554076190,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6428,i,12104251878772957868,2721084357985046499,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4856,i,14960994189299976224,6094715818672885237,2097152 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,17166433831661028695,11682725007721252142,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:5244
- C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{651D4588-4307-4060-BDED-787CE1763985} {02A2F6B6-5B73-453D-8869-E340965ED7D4}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{10DB6DDE-2F3E-4A8E-8010-01B22A057CCE} {8D4A1954-F553-439B-9F98-87BF244E3CB0} 5644
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,14150255762648398944,10688039177340361669,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,9449703451868732843,12251531911552977922,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,14669999779688813834,3338881425624955071,524288 --field-trial-handle=2176,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8dc1ae7bhdf31h4d9ch9128h393092be7ef6
1⤵
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8dc1ae7bhdf31h4d9ch9128h393092be7ef6 --edge-skip-compat-layer-relaunch
  2⤵
  PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc96708bbh4a1fh484fha452h9c3cc813948d
1⤵
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault12f43f2ah7ed8h49c0h86f0h04ad0113e570
1⤵
PID:5440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EF1C3BE9070F6E9DB74D443293267F28
  2⤵
  - Loads dropped DLL
  PID:4248
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3735928F58B059D629781159E140AA22
  2⤵
  - Loads dropped DLL
  PID:5704
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 02546B2B88516CB0C015168A89EBD9C0
  2⤵
  - Loads dropped DLL
  PID:5996
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F2BD27A0B2DEBEA1DA8F2C63BD07DEBB
  2⤵
  - Loads dropped DLL
  PID:5604
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F87DF97D9D35E09EC25C443D9F9CCB5A
  2⤵
  - Loads dropped DLL
  PID:3424
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0A669D384A0A02F18BABFC1CA2CDE585
  2⤵
  - Loads dropped DLL
  PID:5624

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\TEMP\{A6FB2493-D265-4EA9-9AD5-445A7BC61894}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{A6FB2493-D265-4EA9-9AD5-445A7BC61894}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{FBDF2DFC-4F15-4915-8692-60BCA5FF3C47} {9DA4E378-FB93-4AB8-BC56-E3F040D79696}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5188
- - C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{243485DC-0F87-4B50-B016-A20685702C38} {75384E34-9B08-4EC8-B21A-92235F3EB76D} 3980
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5748

C:\Users\Admin\Desktop\rans0m.exe
"C:\Users\Admin\Desktop\rans0m.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x408
1⤵
PID:5196

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5aa145.rbs

Path C:\Config.Msi\e5aa145.rbs
Size 11KB
SHA256 e2a10e3daca350e7c9c62bbeab0180a5fd6217c86a20ab22dfdcc803b25f17cd
MD5 a47e5f5c9f27a0971697c5a2e1bc6529
SHA1 3400225e7e3885bf8d6cc0c606d57247eeb5b70b
SHA512 df5fca2f38479267c832739d6546499b08b53928a0ed4df5db884526548ff2ec6d762cd3b6e64bb2670bc9a990ff0962b73021b339e0ebedfd998c2cc6cda3c1
SSDEEP 192:eKvwTCNyabnt95H3SX/e55NhKnIlNhKn7jEy8FCPePp/K:ecwTCNyazt95HiSNhKuNhK3W8
TLSH
T18E3252926601C2D3E9962B74C70F2B357B73D2DA9348A79F09CDD1245F273CA0F6819A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa14c.rbs

Path C:\Config.Msi\e5aa14c.rbs
Size 9KB
SHA256 71d06be71d0a650c1478aad1803549709bd52afb624f2cd0f7de47e5f861566c
MD5 ac047c0657eb61086f2b042c2d3c2da3
SHA1 05b2a75c1614997ecc89e0e90186b0ee9f552b91
SHA512 caa1f43d21b48e6c94ed0982bd19b15d50ce1878527e9d0544f36736a92300d0ba16eef9d904ae6db2f169cac638b248e2b6d71e8115880e117ecf5c992c8a91
SSDEEP 96:fm0B0yiChrE0NeKaVGUNnUeD2KPKACsTlHUNnUeD2KPKAC6jfsQnUTl+nKLE5t7v:eY0Sjev5N/KnI6N/KnjZEHRvaePpx
TLSH
T1F1122101660487D3F9A26B38DB1727743F76E3DAD214179B089C93748F0BB891F6A19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa151.rbs

Path C:\Config.Msi\e5aa151.rbs
Size 49KB
SHA256 4e3357b2807764b6ae8dabab070585b4d2f616b5170de0b09aa378696619dc83
MD5 61ee30c1b6a029d0c01950248a6b95ac
SHA1 582a1ac8a2e29f2fb7fa7f59ec04e8801de33fce
SHA512 50d090b820529253183d4ca7a6edfafd88f5f0ad49ed6c34f99bbe2a3ea1c4479a7a4a7df3f8eb49376efb493d05a77fdec49afa2eeb84949b4bfd0db0ab2937
SSDEEP 1536:B4OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYe7:l6/R
TLSH
T1C5331E38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa156.rbs

Path C:\Config.Msi\e5aa156.rbs
Size 71KB
SHA256 188763d9c99e0c12ec47e7141c2b633fbdc93da3cc0794553586c0f8233c9c5b
MD5 830646178f951ea2f4169433d1af29ba
SHA1 b2e17a39cd2bf9c01611245bed21498221a778b2
SHA512 a5a19ac3d3bb4ff5ad3e1c785e72012c549335e6a8486804021fba933a5804b0074cd81e8707e5ae2cbb76bfccfc5dbe605f1309fda9bed7364c4ebc65e3dc86
SSDEEP 1536:m+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdW4:Lh0Z7Aj6s4Se9eIOm0i6R
TLSH
T15663DEEB5610C5C1E8322A5813FBFE48AAD9CD67B344463D00C5332ADEB79C6DF68991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa15a.rbs

Path C:\Config.Msi\e5aa15a.rbs
Size 3KB
SHA256 4720e930464675948cfaebde5fc90166b1163630e3b6459e78545e536cb90328
MD5 d19c3f548d07e4c3baf809c7dca5e86f
SHA1 91e73ff8a691ecba0692dc9a4e4cbacab7373c86
SHA512 a6cc7cd698a8711e6a0110227299facb4d32ee4a156e1ce07c3cd06a09d7d472bd343fce695e1ffec2677e69575f436a5e104d631091a131631dab599226494f
TLSH
T10371CF02DA40C6D3DCA22B35CE27176133BBD3DA9324838705DCA5344E4778AAFE9246
MD5 SHA1 SHA512 TLSH

Submit Download

e5aa15d.rbs

Path C:\Config.Msi\e5aa15d.rbs
Size 3KB
SHA256 f24f94cf8364b004e3e12b56fa3a548b5e9bc6ce54446343a08501b1ac48e605
MD5 2880696dbe73b2c8d82c3b3da9998fb8
SHA1 bf7a05c4e8d409959c07654177a1ae7c1e5e51f7
SHA512 40cf82e8d6bff0ec3cfa71f680595b4ee39de2d67996a496b27940bc627ffdcbd49581692f4052d991966b898e6d689a09d1ec04d89ff8ffa010aaa5c8aa4c43
TLSH
T1B581BF43AA40D6C3ECA31B34C9171B2173B7D6D7A364434B00CC92714D67BC69FEA586
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
MD5 522dca4be4f99d21ad35ebc3bb24a066
SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
TLSH
T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\state.rsm
Size 1KB
SHA256 24c268e18fe2fa61b9bfbbec2d225fd38e22f293041cb50f40dd503a0d1b8828
MD5 04262cac692c70373b5c576a90c78848
SHA1 f7033084aebcabed10adc9ae1009d7b9518e8353
SHA512 7e67a7d1bc66b427f121fda5840e5938a40c7f3b99a03842a3041aaae213fba6e17b824d8ea2312c9fab1c8f554d206faa38eb1b3298352e8827dbd847a12627
TLSH
T14921D1515BF6092CF3F6AB3469F96625443BBC121C20C16E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a0d513113e9f65c3c902ef99767ae214ac3f8d32cb0132739d0ab80dacbc9a65
MD5 2d8c1a6fb07fdcd8b15b4797e7a207db
SHA1 f81a5559cdfef81992bbbe60b6f50ff20efb4be4
SHA512 682b661bdad5a998e1f4a097fb76e1e725726db844d73d94ec7c7ba408585e53d7845bb48040543b9a1a594a0ce8c462a36abcb74924acdb7a1d1abad05aeb05
SSDEEP 96:aWwaEOKYzAa9ZW34U6//S1RQcwcndVQvy:AarzDc4Xcw0dV9
TLSH
T185A14B810B52F569FBABA0B0F1C9063F7F33C49602735EA6068CCDBD5309301AC36299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b90e450fcf796ed26195ecd8a806ebee895b173bbb52916c24eb9b68631b114d
MD5 f5b7d70aec6e253b156bcb0e998f5605
SHA1 62845b7d36f462d3559715a624c3c6ba69ea8f78
SHA512 11944dabe48afa5be1d164fc37140a9ec3a53beca45e725cc1c193e4fe60ab90c5f807483a864769bcb77177190ebf7ea621c91eb59b2278f09377d06ca02d79
SSDEEP 96:dXfWwaE5qKYzAa9ZW34MOtYDS1RQhuwcndVQoz:dLaqgzDc4Ghuw0dVt
TLSH
T142B14E810BA6F66AFBABA4B0F1D9063F7F33C09A01775E96068CCD7D570A310AD31695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58beb7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58beb7.TMP
Size 3KB
SHA256 9f42408868f439142ecea9669b801298a12248115020290e80933d5d85dcc3be
MD5 a0f356ed60d79ecb31352e626ac0e4d9
SHA1 719fe2a44c75a5a380db1d7873b5f9cb3130b4f2
SHA512 4f079576a232a291ebb8918fcfd653fd9758cfce16ad525b25f7149c472ac1fd9068b1f311b3e48de44c6ab453506619a93764ae6d46bf4c44b6313b7a5e3f4d
TLSH
T172613B850B62F469EBEB31B1F0DA03077D31809A06775FD6028C8D7D590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 53056ab6c6dee0a2dc1be2b476b88c96d5107a0e1b7fee36b29f858a7254fe42
MD5 6479ee6789be17c2653f5eb8587b2aa2
SHA1 9976886bbf2639d04d40027be1b7cc6b1d198406
SHA512 05b22f9604ae87f7b5eede7045a70e5192e9870f276ccae9d5aa5ec46a5a545b96b1f039e3ff419ace34edaedbc3823f236d877898d7c3fd96adcd91a5b12c9e
SSDEEP 3:MsEllllkEthXllkl2zECllAul:/M/xT02zhqul
TLSH
T10A44044C7FC45505C50410304031C3700374DC117D1157533C51D4537CCD5400C0541D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4d7c94c5ea4aef0631a5e3f92351287a445fbca4db661d0dfb455f8b3fd4991
MD5 83137906545731ccb2bf0b81605788c6
SHA1 d322cf9264e2579cc0ad8db770403c0711c01abc
SHA512 8f05b52b353c094eebc36cf0584574d6adf22881a670552c40b0a401b78bc65caf61a29c60764c71977bc6ef62d6a533cfd80c9056c171ac7ec6802e8b9548b0
TLSH
T1A9417CF787E1956D8A125AF0AA18EE2BCE2C0511831C786985E4BE57D3E3871E101B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c76955e360eed958fbade6e8ba580e35ac308a9c60e871607ca076bcfd7f52f7
MD5 fc637a07da50fa0a14d57197790954bb
SHA1 c6be2ec1932eb4220582f54c7cde39f67ade558a
SHA512 358ab64d91cfc02dc31e0e443ce83f73578bb5b713bf935c2175643fcc2d014204e1c4d1d2692d948afe1c98ddb9814d4bdffb73bafdc8aed4aaeaffe1ab4b9a
TLSH
T1C4715DF747B1956E9A119AF09A18EE2FCF6C0215431C786989E4BE23D7E3472E00275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b68e63347cc03cb3793dd6b91a026f193d01fb2b793b7ad56af586033b6b1dea
MD5 3da29b5d62ef9208a7158f8fa30bda88
SHA1 80c28a47d9e359e2ddb76294bf0def365667179e
SHA512 6f44b71cbc2f8ff2b7b67933c3bae00c902eda94d98799ca26cf515b297641dcf381eb7c5ee9fe252ab0f6a722c9e088be76938dedb1e691713733a0c97cb02f
TLSH
T176715DF747B1956E9A119AF09A18EE2FCF6C0215431C786989E4BE23D7E3472E00275F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1977f5688da96ebbe419b95354534b61899e8a7a542e98a4f003e6d9fb873c19
MD5 f2517438b62eb159c21ff125dbc7e566
SHA1 2401d7c5c9127bfd832102619d24d22cd37b6596
SHA512 0f9d1a55534689990cee70fdde1cde74707bac11d5274cc9c8a0908c1fc6ffe928e3bdca8f13bb6c45ec8ef273fc5dd6ef8177e79d7784dbf5bb2bc9d88bb30c
SSDEEP 192:sxZ4RTyM/jK1Ml8UQIn4/fIPXsL/WpVkKIdpvoxQHW6+WNBTMutd+IDXYIcP2/6p:sxZ4Zqm4/fosbWvkDJHbBsAXag2
TLSH
T11472F912AA34597BCCDBD20DFA51BB93D6F94422A6945E4499FC8D1C00E7BED320381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4e1df3bb80aed3c7f3edcfba9562b9a6b867c9dc303841c016f3cfd4d67d0e3f
MD5 c9e8fc33ec366148e25d12befe780978
SHA1 6129776171635d6a78ec1858161ebd7cd1fe7b94
SHA512 e9eedb2e9c7b9c76ea2e71ecbddb606226d8821774fa6a6fd9d672f661f0fdf15d4515aa65844f5ba335b29ac65c6c62611fcd0affa34ba7e8d397f79f62c456
SSDEEP 192:sxZ4RTyM/jK1Ml8Mn4/fIPXszqwIdp9oGHW6+WNYhe/Ywd2TZlIgIJ:sxZ4Zv4/fos+RhHbb/ks
TLSH
T16152F8116A34697BCCCBD209FA55BB93D6F94432A6940E44E9FC9A1C04E6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 86a78fbb6c7c6c23419998d119b788ea4019872529322a17e9057310702346e7
MD5 a337f9e2546276b37f37256f858c8379
SHA1 ad95904c16b71c3ddf24d2ae101e1dc47cd04413
SHA512 12ce672f6c746f3cff52fe69719f95d1de4d7f592b88af115687be43504e2c5fe5ddbe7b3c1981b8d0051da9b819c1d8b8436ba8d17b4ac4c22b97af2de4d847
SSDEEP 192:sxZ4RTyM/jK1Ml8UQyn4/fIPXsLdwIdpvoGHW6+WNY+IDXYwNP2F1lIg52J:sxZ4Zqg4/fosZRbHbrAXDI0
TLSH
T1D962F912AA38597BCCCBD20DFA517B93D6F94432A5940E44A9FCDA1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82ea64c3a7cf46e65993572f7185102db57184f22d473f187981243606dac856
MD5 0b3fcf53b78b5874088d25281fc7823d
SHA1 c88eb0207a27a25cdc1889ec3364ed60bf3fac92
SHA512 e7741bc9d0594c7a8000436a5af0400722d53b06fbc6c7b70d7fa363a7132bd91ceaf15f82a114ebe0686735979682516a7df8037c97fa4baf98f01468ec23bf
SSDEEP 192:sxZ4RTyM/jK1Ml8M54/fIPXsLqwIdp9oGHW6+WNY+IDXYwf2TZlIg5AJ:sxZ4Zh4/fosmRhHbrAXWq
TLSH
T18A52F9126A34697BCCCBD209FA457B93D6F94432A6940E44E9FC991C04E6BED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e4aec0f4c745bf76ebd7ffd64e33faaedfa350ad30fd52d18a9e34f176a6fb15
MD5 e1af798b504542f7c1e821cacf4d5f78
SHA1 c53eccc9a7f9af073e54dca3288d610daf4f6bee
SHA512 09fbbf9689131002d5ce03d27bdec7e8dcf94ec7ae57c4f123a9ef11bcc51c438e0c96bcaa8235d9afd53280208d9727747be24bc1faacc8f53ee500ac68389a
SSDEEP 768:fI4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dgrohncxay:fI4jeXmWvmKLEu1jacPLZQdri3
TLSH
T123D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7b784b55ef817abdaa8b6e89aaa6206b9afc8f0fe7f79a11e3a56367f4b60df8
MD5 b36a6b4e2f5d23653df1daf98adbce5e
SHA1 704b0447b1f9369be401f6f8eb20e42e037c43ce
SHA512 44fc3f8a88587e5065e670345939b1eb71386b7a2dd12ce03951abcaa261905736f4b6b1e73205abfbed4d97b909fa0bb66a786cbddcae3f2bb95fedf5d85e12
SSDEEP 48:KMiNMA60EFT4P4IGYFKB0ZKFFCVgn4k+ydbIlKEcAsrI9KQcw/yJz:KQpqKikaubaKEcvr2KQciKz
TLSH
T1B6915212367F02027C7E295CA355C71B368276A33019E62B37A810714E6BF298DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2543a1452f3a4345678989d6a9ac7cfda2c6e41f07719d5b5cb25df4c458f6f1
MD5 07d6482d5a1aea73323f9efcea1ffe00
SHA1 8f7146c6c9d62a4a2fc09f456ee3ca7e3b0cb354
SHA512 d6c0279209beaad488189a3f3b7e28cc9a5dd5dc8fc4157ded93e97e11c08cfe926d2b196babea8bbdfd9e4cb8e61eeb38d84694b5f8a4076bdda7e2c41158b6
SSDEEP 384:4F1ZcISssNN8TUNTUlIlEXP+EF2rf++OWYXN+26F6sa+VYbuoi:4FNFswgGW57HOVNls6hg4uB
TLSH
T139C209F248D78876D8AE9743E77E2E138DBCC057B594AA90B3D85A1CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ed0643fba838efb78fded49dfd1281f3da410164d567aa2f84ab8e90858e070e
MD5 0eb0717bcdb58fd0856773cc8bc62d68
SHA1 7b8c1474f100b4020340ccbe565a3fa634593190
SHA512 cf4e3bb9926116ce9eba70b79cc9b1a2fc92d69824a97060d1f6f26f942e619fb88635e2a870d7ca1090be98d6b99ef1e9af088ffb952f02d57da7a640ba91ee
SSDEEP 384:4FPZcISssNy8TUNTUlIlEXP+Ei2rf++OWYXN+2vNF6sa+VYbuoi:4FHFFwgGWE7HOVNlvn6hg4uB
TLSH
T110C209F248D78876D8AE9743E77E2E128DBCC057B594AA90B3D85A1CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 4b86fb7338e3ae84adc5f780d5c0b4d26caf0b0ecf2e4d26f61c1a2514e7e3a3
MD5 52bcd3da9c94f848eaa8fd93dd135688
SHA1 52a371a9d435ce051dedf0bb61b9c30f43012e66
SHA512 ce52209f44b6eb259e1e26a9efdba41dad8c3a4d63d082df12710859c6dd4a9fc98f1e2985145daa198ce468b5a075cc3b7b2ac1be655c607de6864d608ebabc
SSDEEP 384:4FdZcISHsNm8TUNTUlIREXa+ES7s2f++OWYXN+2v1FEQvKASBAw/sDqKkBdsa+VX:4FFKtwgKXBsmHOVNlvvdtSmDqtdhg4uB
TLSH
T17DE25CF184D74CB6C4AE9BC7A77EAD0259BCC067B4985558B3E46A2CEC4B1BFD302814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 89faf1c6e95d6d31ee1157b57b48da31281c04cea22e52a8638bcc9f7bc79927
MD5 f0dcf8ddec055860ee7511f155a62fa3
SHA1 cc34da5e29ee144e976d239fcf4c49b91638ce9a
SHA512 3847e2c530b63f677b4f5035d2e3b05af2857451646ffe2bbbde154d354200bcd3936fc7faeae976ea1765972be65d7d354d679dfda7f7b5a2ed9eb5fd42c047
SSDEEP 192:EON06hZ0QmiUy8opc/+jV4O1cYa5wOZFpU6:EON06o8pu++OWYh2/U6
TLSH
T1CD02C83568686C778EE2AE45F48B77235FE4112BA9956FC4EAE81B1D00C769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f563b9acfb61876c20c62b06eff49e42401f4cee6b2b5291442a79a6209ffdd1
MD5 593270cad83d9222cf53b1ece2a00689
SHA1 7af5a54d053e69c630b1fd657723990a8e896256
SHA512 9c2e585c587d4923fcecd17754bae346561666f6452c5cdbdbb83bd77340440fa38f6bf18e68dd8f6163005493d749389f4661c3d87f48d90c799d2ac87743a6
SSDEEP 384:sZcImsNzxXP+Ew1Irf++OWYXN+2mF6sa+VYbuoi:6m6W767HOVNlY6hg4uB
TLSH
T1EC826C316D389C7358F3A255F84736138EF8D067A6C96F94D5EC6F1D04DA6AC230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e1ccb18ebad0baf7095aec018a33e10e60f11be78cbd7c6f4cb56b043dd04f1f
MD5 1a256d20888ee1ffb825a3853d6f2ac7
SHA1 cf1b6ae05028e966a34e4eb6d6ad1c253598151b
SHA512 29b8fc0e5234bd69d97491c6e97a0c8832ff864e145812035c87175736aa790b90f0c519ad82b407164407bf8da56926b18a89481600c11af4e2fcc7e781182b
SSDEEP 384:LZcI9sNzFXP+EFIrf++OWYXN+2mF6sa+VYbuoi:T9OWr7HOVNlY6hg4uB
TLSH
T171826C316D789C7258F3A255F84736138EF8D067A6C96F84D1EC6F1D04DA6AC230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6b04f3623c272ae84e21f8266ef76f4626e1023b00cdc65d7805adb32537981c
MD5 7fbd128d49793721a477bb082dce80b9
SHA1 05876f94a911914f804ae041049f40398398d5a4
SHA512 1d9e5e293c7ac04c473728a65a0a98b49e54cbea714a6f736299697297e681ddc9296898302f5da9016b23c974abbbd9c11ba701c59fa6fb1bb4c9cf831ac721
SSDEEP 384:HZcI9sNzEXP+EFIrf++OWYXN+2mF6sa+VYbuoi:v9NWr7HOVNlY6hg4uB
TLSH
T184826C316D789C7358F3A255F84736538EF8D067A6C96F8491EC6F1D04DA69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 13d173bba782aeae545e31b77be5cf374f9808bc2290e081119217c966ced04e
MD5 6abddd0202b5ad806e7ed88f432f4293
SHA1 f610132bb81adca8a9c2143d602e8b5b85ee8b7d
SHA512 18a7fb3b6bb8cd2f638bb525c67359118f9f9f86cc5dd76073ae575b771942e465f86565276e9379e0e5de412c03404ee82aab63ba0f2aa5f1418ad650b5b79c
SSDEEP 384:4FAZcISssNy8TUNTUlIlEXP+EfbMs2f++OWYXN+2vNF6sa+VYbuoi:4F+1FwgGWvsmHOVNlvn6hg4uB
TLSH
T189C209F248D78876D8AE9743E77E2E128DBCC057B594AA90B3D85B1CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c5a0cb65c57b0d8eb2032191e2157809a749b80537d6c00915670fd3533cebe
MD5 455e33c255d81999bd7a44fe6a02077a
SHA1 4876107458d709406b59a22b541053465fde4484
SHA512 4e67cef2f121ca7d55d7cda76cb42d6f6971b2425182916cb6f11b1c84816cc1afe4d31a6f6b640ac322d73347aa6ed10b10dbe6e4736f1721553f90e07d743c
SSDEEP 192:FON26hZUQmiUyUopc/+jV4O1cYXN+2U5cOqwqYU6:FON26w+pu++OWYXN+2n96U6
TLSH
T1D5120A356868AC374DE3A655F48732538EE59127EAC57FC4E5DC3F2C04DB6AC230A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2f188ca-283b-4df4-b715-d0919d7db360.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2f188ca-283b-4df4-b715-d0919d7db360.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b14d339386ce26560e5d7261b3e38e9e9c82aec6b380a69f188446f7ec4648e
MD5 8a7b37659bb945f565340cdc98b5bb49
SHA1 7a62deaed67ff2b1e1a516fce02df6774418a071
SHA512 8055e55e90bcf6b85d6ae34199f29ce73dbdeb13a4f9f0e0f67f177b137d2e4129cc27084f4b6c8d163ef7b411b69931834655842725097ccc91840b138e3baa
TLSH
T1CF411858A6F90148B3B76F5AAFF7A56E447BBD373E0AD59E00010E4F0A76A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141_000_DotNetHost.log
Size 2KB
SHA256 43c31e9d0d20fca27479bf34f096d2a330996af53c47e68d134536d54ac647fd
MD5 f231c10b783f1720d933726bede065f1
SHA1 0db266cb1b7aa052e0714ab1617efb8187744ec0
SHA512 1e89f9ac2abf8399ef0ea21182f11e7f96e8ff1388f2f996fcb4d62b9d1df48303783581ad6d70b9d1cef4ef9c4d252d72f31a7f360e36da9936609c095de2a2
TLSH
T17F41E4602BE40906B2B71747EFF3C4216B33FCE56930CB4C2249811906AB9059DACB7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141_001_DotNetHostFxr.log
Size 2KB
SHA256 c0283ef244803a14bc0ee269d4d0412cdcc94473a2f6ed95b84fdfec456d42e9
MD5 f2e63295ab8f4f8cd678e1006a2d8054
SHA1 af6a075c4a83d07333e4e64b69ddf9d01cfd3efe
SHA512 056fc65de3fe5c92fc54f59dd6fb21a90b0952fe303350791559c1dae3777f6fe43e6b19cb407ff1484a1d8a627648436702fd9bda4d831a834cac0cbd61452d
TLSH
T1E34134152BE50845B1B75617EAF3C4369B33BCE56934CF1C224582290A6BD026DBCBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910175141_002_DotNetRuntime.log
Size 2KB
SHA256 9fef40ebcc86da158cc0cbb44df6178ebf47cce81d3f4cc3dea274033ab0f596
MD5 a9b2311568db4f2d1d1ed49f39e67f27
SHA1 d8661ed11313d280c27f76954c8eabe7f789e5c9
SHA512 7949742707b2cc2e7c11c9d1cf2cb990a8f1d5173364b51208e80e74073a496dc4613972db11353dfdd266527938296e86438d294d302a715246e553018e258c
TLSH
T12B41F7292BE80845B1BB5757EEF3C0218B33FCA59830CF5C238542190667C0269ACBBE
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\DotNetHost
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\DotNetHostFxr
Size 920KB
SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
MD5 0dbebff80e13ff5ab5de800e763e5b37
SHA1 e044e032e89bbdededce81d655ae84e3123d367d
SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
TLSH
T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\DotNetRuntime
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
MD5 6712931c838d7173b4fe90e26cf3b44a
SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
TLSH
T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28ac0c53-7bd0-4add-8eea-2a485b53cd3c.tmp

Path C:\Users\Admin\Downloads\28ac0c53-7bd0-4add-8eea-2a485b53cd3c.tmp
Size 746KB
SHA256 a130edddbda818212e83ef178458f0ecbde96122bfdd817176ab638bba42af30
MD5 59647a25245328f7226afb9dccfa9b47
SHA1 186cdc081285095dbeab45680b6941d31ff5a2c6
SHA512 cf5778707b1cc584e6878fe72e228b335ba56e25f49748699dfe8b7391c088ac4eaf0c4679d89b1aaa2b94ce23bb467ee4575da1fea8965a21a9d7df65a693e5
SSDEEP 12288:PgRF15UiGx9pmMECz6O0DKDd8+FeMqqsN0Z63JwzOfjP:4ZGx9xECz6c9EnfjP
TLSH
T107F48C25E3C40569E33FE1BCC6964503F272B85253B1E6CF0694CEA91F53BD0AAB7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA356.tmp

Path C:\Windows\Installer\MSIA356.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{B5FC135B-ECAE-41B8-8866-C43F60598A71}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4204-1440-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1430-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1439-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1427-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1441-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1478-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1477-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/4204-1476-0x000002443FA10000-0x000002443FE9D000-memory.dmp

Download

memory/5052-1472-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1467-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1471-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1470-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1469-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1468-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1466-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1460-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1461-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download

memory/5052-1462-0x000001ED73640000-0x000001ED73641000-memory.dmp

Download