7abedb7bd160a5b1ef7467dd58dd70b6aa50b2983f54c7dab0cd100adb645dcc

Analysis

user interaction
yes
max time kernel
301s
max time network
307s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rans0m.exe
Size 52.3MB
Sample260910-wezavstbqc
SHA256 7abedb7bd160a5b1ef7467dd58dd70b6aa50b2983f54c7dab0cd100adb645dcc
MD5 f63b3544d5007af53976c71516612f3a
SHA1 cb9bbf84ba519aa4d8cdbf5da9d56e00eaf966f4
SHA512 367fe627db7a17e05dbefd8106c7a1b3a4128987d7d5ceff8acb17983f1f6da4547a5bf40b287a8507819cc5e2ec1a52fa0f6a5d9246a808f4763337568267d0
SSDEEP 786432:3i3/CStoACa66Z7lZrZzFY1NdjgJ/LxOjHyqsaWCuyYjV0XshJWcoZ0causDoXq1:it3ZBZjqxaJCusshkbZnmYNeRRd+UH
TLSH
T180C71215E263E700C1ED9536DD42C99447217D469F029AEB2078FB8B7A723C3BD3269E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
93	4460	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
2360	windowsdesktop-runtime-10.0.12-win-x64.exe
3580	wixstdba.exe
3048	windowsdesktop-runtime-10.0.12-win-x64.exe
4236	windowsdesktop-runtime-10.0.12-win-x64.exe
5656	windowsdesktop-runtime-10.0.12-win-x64.exe
3556	wixstdba.exe
2672	windowsdesktop-runtime-10.0.12-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
5312	MsiExec.exe
5312	MsiExec.exe
4220	MsiExec.exe
4220	MsiExec.exe
2312	MsiExec.exe
2312	MsiExec.exe
4324	MsiExec.exe
4324	MsiExec.exe
4532	MsiExec.exe
4532	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe
6008	rans0m.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\darkred_wallpaper.bmp"	rans0m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\FpxHdcLwDS.jpg"	rans0m.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Accessibility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\UIAutomationProvider.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFC73F06600C0A7738.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_952030859\protocols.json	msedge.exe
File created	C:\Windows\Installer\e59a8d9.msi	msiexec.exe
File created	C:\Windows\Installer\e59a8e0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF77BB34E3B0FAF5CA.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a8e9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB250DFC25D578F47.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_710289392\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_710289392\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1776120343\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\e59a8e5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a8ea.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB984.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_7496152\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_7496152\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_710289392\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\e59a8df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a8e0.msi	msiexec.exe
File created	C:\Windows\Installer\e59a8e4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C8C4AA34EFFD657.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE744.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD208985DCE8FB77C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0D44E2EA5B40CA41.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39D8E8C3E11A234F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF483C90F7B8783133.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1776120343\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\~DF0C160884E3F1DCF7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF874A24AE7351712F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_388600244\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIBCD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a8d9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF11B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e59a8e5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF216.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF13C5BB71D73483A6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3B71188E26AB2813.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_388600244\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_7496152\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF1CA1E15845017240.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6A8BEA4D7C24214.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1345788868\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1776120343\travel-facilitated-booking-kayak.js	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID05E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB0BF2DE309DA5095.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF488.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_952030859\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_710289392\LICENSE	msedge.exe
File opened for modification	C:\Windows\Installer\MSIAE38.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3F9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF062420CF4490A2C5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4E7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF76F10E279C482977.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{902710DF-F5E0-42EB-8959-ECC10CC368DF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC438.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	msedge.exe
3160	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335362900136239"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\PackageCode = "A67E422DCB5A6B244B1F3508AB24FAC5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C\7F0F853E6220D914586E4DA580FB91F5	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{902710DF-F5E0-42EB-8959-ECC10CC368DF}v80.48.58476\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F0F853E6220D914586E4DA580FB91F5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile3	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile4\DefaultIcon	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\ = "{E358F0F7-0226-419D-85E6-D45A08BF195F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\ProductName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gold5\ = "GoldFile5"	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.crucifix	rans0m.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F0F853E6220D914586E4DA580FB91F5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{902710DF-F5E0-42EB-8959-ECC10CC368DF}v80.48.58476\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\PackageName = "windowsdesktop-runtime-10.0.12-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile1\DefaultIcon	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{17D94539-A423-48D9-BD4A-69A9186C5B66}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\ProductName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\DisplayName = "Microsoft .NET Runtime - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\ = "{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}"	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{DE2C4FE9-B884-4F1D-9EBF-CBECC1675D55}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\PackageName = "dotnet-hostfxr-10.0.12-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gold2	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile2	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile6	rans0m.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\PackageCode = "1996005C24BB6ED459236374EB503368"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile3\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\RANSOM\\Icons\\gold3.ico"	rans0m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gold4\ = "GoldFile4"	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile5\DefaultIcon	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.gold1	rans0m.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\GoldFile1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\RANSOM\\Icons\\gold1.ico"	rans0m.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
1964	msiexec.exe
2868	msedge.exe
2868	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	1964	msiexec.exe
Token: SeCreateTokenPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLockMemoryPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeMachineAccountPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTcbPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTakeOwnershipPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLoadDriverPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemProfilePrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemtimePrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeProfSingleProcessPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncBasePriorityPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePagefilePrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePermanentPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeBackupPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeShutdownPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeDebugPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAuditPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeChangeNotifyPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRemoteShutdownPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeUndockPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSyncAgentPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeEnableDelegationPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeManageVolumePrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeImpersonatePrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreateGlobalPrivilege	3048	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3580	wixstdba.exe
3664	msedge.exe
3556	wixstdba.exe
6008	rans0m.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6008	rans0m.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1964	msiexec.exe
5312	MsiExec.exe
4220	MsiExec.exe
2312	MsiExec.exe
4324	MsiExec.exe
4532	MsiExec.exe
6088	MsiExec.exe
6008	rans0m.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3664	4792	rans0m.exe	89
PID 3664 wrote to memory of 5752	3664	msedge.exe	90
PID 3664 wrote to memory of 3556	3664	msedge.exe	91
PID 3664 wrote to memory of 4460	3664	msedge.exe	93
PID 3664 wrote to memory of 3556	3664	msedge.exe	91
PID 3664 wrote to memory of 3556	3664	msedge.exe	91
PID 3664 wrote to memory of 1180	3664	msedge.exe	94
PID 3664 wrote to memory of 1180	3664	msedge.exe	94
PID 3664 wrote to memory of 5280	3664	msedge.exe	95
PID 3664 wrote to memory of 5280	3664	msedge.exe	95
PID 3664 wrote to memory of 5280	3664	msedge.exe	95
PID 3664 wrote to memory of 240	3664	msedge.exe	96
PID 3664 wrote to memory of 240	3664	msedge.exe	96
PID 3664 wrote to memory of 240	3664	msedge.exe	96
PID 3664 wrote to memory of 1816	3664	msedge.exe	97
PID 3664 wrote to memory of 4904	3664	msedge.exe	98
PID 3664 wrote to memory of 1816	3664	msedge.exe	97
PID 3664 wrote to memory of 1816	3664	msedge.exe	97
PID 3664 wrote to memory of 4904	3664	msedge.exe	98
PID 3664 wrote to memory of 4904	3664	msedge.exe	98
PID 3664 wrote to memory of 2928	3664	msedge.exe	100
PID 3664 wrote to memory of 2928	3664	msedge.exe	100
PID 3664 wrote to memory of 3916	3664	msedge.exe	101
PID 3664 wrote to memory of 3916	3664	msedge.exe	101
PID 3664 wrote to memory of 3092	3664	msedge.exe	102
PID 3664 wrote to memory of 3092	3664	msedge.exe	102
PID 3664 wrote to memory of 3296	3664	msedge.exe	104
PID 3664 wrote to memory of 5388	3664	msedge.exe	105
PID 3664 wrote to memory of 5388	3664	msedge.exe	105
PID 3664 wrote to memory of 2704	3664	msedge.exe	106
PID 3664 wrote to memory of 2704	3664	msedge.exe	106
PID 3664 wrote to memory of 2704	3664	msedge.exe	106
PID 3664 wrote to memory of 2540	3664	msedge.exe	109
PID 3664 wrote to memory of 2540	3664	msedge.exe	109
PID 3664 wrote to memory of 4320	3664	msedge.exe	111
PID 3664 wrote to memory of 3552	3664	msedge.exe	110
PID 3664 wrote to memory of 4320	3664	msedge.exe	111
PID 3664 wrote to memory of 4320	3664	msedge.exe	111
PID 3664 wrote to memory of 3552	3664	msedge.exe	110
PID 3664 wrote to memory of 3512	3664	msedge.exe	112
PID 3664 wrote to memory of 2360	3664	msedge.exe	113
PID 2360 wrote to memory of 3580	2360	windowsdesktop-runtime-10.0.12-win-x64.exe	114
PID 2360 wrote to memory of 3048	2360	windowsdesktop-runtime-10.0.12-win-x64.exe	115
PID 4236 wrote to memory of 5656	4236	windowsdesktop-runtime-10.0.12-win-x64.exe	120
PID 1964 wrote to memory of 5312	1964	msiexec.exe	121
PID 3664 wrote to memory of 2868	3664	msedge.exe	122
PID 2868 wrote to memory of 5932	2868	msedge.exe	123
PID 2868 wrote to memory of 6112	2868	msedge.exe	124
PID 2868 wrote to memory of 3160	2868	msedge.exe	126
PID 2868 wrote to memory of 6112	2868	msedge.exe	124
PID 2868 wrote to memory of 6112	2868	msedge.exe	124
PID 2868 wrote to memory of 3276	2868	msedge.exe	127
PID 2868 wrote to memory of 3276	2868	msedge.exe	127
PID 1964 wrote to memory of 4220	1964	msiexec.exe	128
PID 2868 wrote to memory of 936	2868	msedge.exe	130
PID 1964 wrote to memory of 2312	1964	msiexec.exe	131
PID 5656 wrote to memory of 3556	5656	windowsdesktop-runtime-10.0.12-win-x64.exe	132
PID 1964 wrote to memory of 4324	1964	msiexec.exe	133
PID 5656 wrote to memory of 2672	5656	windowsdesktop-runtime-10.0.12-win-x64.exe	134
PID 1964 wrote to memory of 4532	1964	msiexec.exe	135
PID 1964 wrote to memory of 6088	1964	msiexec.exe	136
PID 2868 wrote to memory of 2972	2868	msedge.exe	139
PID 2868 wrote to memory of 4160	2868	msedge.exe	140
PID 2868 wrote to memory of 5880	2868	msedge.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\rans0m.exe
"C:\Users\Admin\AppData\Local\Temp\rans0m.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb21a7c188,0x7ffb21a7c194,0x7ffb21a7c1a0
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,7278750536589553949,1102028816264637871,262144 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:2
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10554402449345945211,9495978794170269237,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,15284393720691064091,10303344294790209835,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12318007397634662224,2853736629017038381,2097152 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,14321206195783627288,11710513967157674053,2097152 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,12959411340910968154,13553841408353556293,2097152 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14561485841717323431,7826174027532853359,2097152 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,4232784595135696851,8401803975341407172,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,2251872235623541440,14979188171254280294,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,12573706366501766068,3117860652497877396,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5565605521607889043,1759294103706483411,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5565605521607889043,1759294103706483411,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,3869168571391916117,15339573332261796930,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6260,i,274801811904077879,14318970277268439839,2097152 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,391726978720462675,11123164567346312789,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,6851773138515670091,17753855337532343080,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6684,i,17726339666252643203,4500580008437623837,2097152 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,84084444383142771,2146684014536912766,524288 --field-trial-handle=3008,i,7330279394839559907,1150973600335842410,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
    3⤵
    PID:3512
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{BA33FCDF-3AC4-400B-B544-5714210C3D16} {0BBAA4F6-5481-466B-A8ED-99F241D8C0D5}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3580
  - - C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
      "C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{C725E525-87D0-48A5-B514-058FD5B0F32C} {DC62ACBE-54F6-4F6D-BF69-EE471C5FC513} 2360
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffb21a7c188,0x7ffb21a7c194,0x7ffb21a7c1a0
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3149024771913658904,7974788586557309660,262144 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,9377067651957099294,6725154238697927612,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:11
      4⤵
      System Time Discovery
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,9257817547246410428,4251851888373194180,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:13
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,12375869553981059117,2218842920965621744,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,12375869553981059117,2218842920965621744,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,8758699117755668835,9385208431996596981,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2051172757156269708,13971338929090220558,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,7750516495415124636,5990723627514627965,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3377382338181381898,14355888862400991090,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,10979839038237057092,2872916853858647156,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5116,i,10942597972252045729,14094106604989261989,262144 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,12981302039539036210,735326142268683867,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,16946067607830932961,7277957070042340230,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,1904188469581048938,4218360817106493860,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,17680179245102218370,5246404110391352467,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,5190723963540265198,4215619362351725688,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18387835622122998019,8505597542725636544,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,15749660996796825550,7772840405183209542,524288 --field-trial-handle=2256,i,17051259785164626211,7118449794300666353,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 03553BA0FC8E3D613B0B78E4AEECD4C6
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5312
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FA6826E78E2F0477EC895EA1EA1F24E1
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4220
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5517AC80EA956FF84C3AEE88A92A8734
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2312
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C1A33A8A1428138B47B68FD0EF62428F
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4324
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AD80402CE9E1557C1EBAE015DFA0EA7D
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4532
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EC7E827B0310DED2AE2CC462FCD6424A
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6088

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910185146.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\TEMP\{572B2063-3E5D-4696-81A8-2D07B1B42CDD}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{572B2063-3E5D-4696-81A8-2D07B1B42CDD}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E56201A3-6B79-40F5-8E3F-4C2EA5E90A68} {4D3101E9-E25B-4A52-9A41-04706F62AABB}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3556
- - C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{7412D738-3850-4CDE-9537-D185778D2F66} {C9E9FB8D-37E5-4B54-9281-B0D654BF186A} 5656
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5044

C:\Users\Admin\Desktop\rans0m.exe
"C:\Users\Admin\Desktop\rans0m.exe"
1⤵
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004DC
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

e59a8dc.rbs

Path C:\Config.Msi\e59a8dc.rbs
Size 11KB
SHA256 72ac9bdbf8c93cb745573d9895d24286b820462da79b938da155869e49f691cd
MD5 a49fdc3463a9622c9e2d2699b3ead250
SHA1 c135639444e9466066c77f282ff1a3fae0f77d49
SHA512 213f84c6f617363a9c0e104b9e37442a844322b4a16a2abc6c35e8f66d7346b617199d290a5a36c089fd022a22992b794f5c7b4c284ff2aa9be97c166b3f3741
SSDEEP 192:TKv1TCNyaDtv5HqUSO9C75NhKnIlNhKn7lEy8FCPePp/K:Tc1TCNyaDtv5HmdNhKuNhKVW8
TLSH
T195325191A60182D3E9962B79C70F1B357B73D2CA9348A79F08CDD1245F273CE0F6419A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8e3.rbs

Path C:\Config.Msi\e59a8e3.rbs
Size 9KB
SHA256 d2d70b1bd98d35423587b641e08afc734ed5d4efc27fb66e400bacced98749e9
MD5 45a4a2b428db251502d34f580322d9ec
SHA1 c329d373656006cce43729bb4d8665b07c845de9
SHA512 78b51a6436291788ab842643881ff237ebf1a26b956412ea2bc09c6e3f66aa07d2933094f56fdb62a6dd0dacac8a5e6c752e31b21c8689d1b74b58903dd510fc
SSDEEP 96:xm0B0y/ALrE0MC+1saBVGUNnUeD2KPKACsTlHUNnUeD2KPKAC6jfsQnUTl+nMLEP:MYJ+KCk5N/KnI6N/KnjZEHRvaePpx
TLSH
T1BE12210166048BD3F9A26B38D71727343F76E3DAD214179B089D93344F0BB892F6A19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8e8.rbs

Path C:\Config.Msi\e59a8e8.rbs
Size 49KB
SHA256 ee1e2effb42b77be356efc905613b4eb471c711c54f87f6032422edbe38cf2a0
MD5 ccd950bd9706c5972297ccba2c7457b9
SHA1 63869e65e35c48a9c88b4a071113103be5e888be
SHA512 f7d12d3e3917b178afe5b50cc646cf9a2586d28012a22cf12c5849ef3cb02853a4b38c7d4a6ba396a808a1db68d0b38f88e2afbd721da3b049c8da2fa1ae025c
SSDEEP 1536:34OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYej:L6/V
TLSH
T131331F38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8ed.rbs

Path C:\Config.Msi\e59a8ed.rbs
Size 71KB
SHA256 7bbcb4c8fae2913659acd7bdfac5b76aeae66efe66167a734177eef90d641b58
MD5 7e7502cffa2ad9c7a136067e163a460d
SHA1 d59fbfc43d0e6e7c91cdf940a729a60b62817403
SHA512 7a36fb839c3463844a9a1f86417e7ee0089a6c7624fe05288f10976ee1c4fa395c26181fcb0ecd19562f44a21c0bd5b1152150ad4d8034a826d566024cadabcb
SSDEEP 1536:A+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdW/:dh0Z7Aj6s4Se9eIOm0i6k
TLSH
T19E63DEEB5610C5C1E8322A5813FBFE44AAD9CD67B344463D00C5332ADEB79CADF68991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8f1.rbs

Path C:\Config.Msi\e59a8f1.rbs
Size 3KB
SHA256 2d365491b6d5afc28a91151f535a6fe09bd2b9a1e18715642c8cd9ceb7fb6524
MD5 6e57573adeb98837a8532b3204e5b2e2
SHA1 4a28395324815dd484b7876e8b457f05e191446e
SHA512 089ba196f6f94c1f75c6b0af9d7a4688f88c7a1bacd8ce29c47eceeda6b0a4f3f40dda99af2b2eae246b46cb0494070ee81030987e59beb9d74e4ab40bb93c1f
TLSH
T14471C002DA40C6D3DCA22B35CE271B6133BBD7DA9324838705DCA5344E47789AFE9246
MD5 SHA1 SHA512 TLSH

Submit Download

e59a8f4.rbs

Path C:\Config.Msi\e59a8f4.rbs
Size 3KB
SHA256 f9031c71efd98efb639f00b497ff15ca97150b86bc2253393a25f6a2f3f1cbfb
MD5 fbfe47b6437873d3af8e82169e8b546c
SHA1 d9bc4aaed682b9ef9e325d0267613a4f7cd1b030
SHA512 c9b692410d861b584f396cf5516f79e775d2544e679ee4169d82d908ff1786e158bfde62beaa2414ce464b6a3086c878c57050bbdfc3dba24a9ac1498d770efe
TLSH
T1E281AF43AA40D6C3ECA32B34C9171B1177B7D6D7A364434B10CC92714D57BC59FEA686
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
MD5 522dca4be4f99d21ad35ebc3bb24a066
SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
TLSH
T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc68b9d329676e82624ffd45f47e3380b0b887a7878e32928387600c754cc854
MD5 2dade22fab8aa9688d980af274f191f0
SHA1 9485e8aeb68cdc406e4c834151a7eef108a761c1
SHA512 50c57d31899efd48d3b098570671ed3ac037c694969ce463d44ff34387b014daaa1de4ef44cebefddbfcb1212590ef93587ad1687b0c72b9fba176f88cc4b93b
TLSH
T120D0972498ACB3E0E023117984202300319800A1B8A31306A0200D0D8E2009323DBADA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5c95363152f1249b2c78c3746f5d204d55aa6790056355bfacf658e64f74c3e
MD5 ae5440a5154abdbfb7fdd6f126f815a8
SHA1 1858d866ba52ea12207f1779de6c4286b57fa37e
SHA512 fbfdb454e0881b48a6d3e55528a82cb5ff1c791247add6d447313c689e3509471feca4aee819ea5ae22a7df14fbb7bece8e6619bc5104a81e944e7ca5fd892cb
TLSH
T158D02324F68CE3E0F51304B08920632D32F94150BC6397157072254C4E0042313DF1CA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

273bec59-e0c9-401c-b740-b41ae5f01cb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\273bec59-e0c9-401c-b740-b41ae5f01cb0.tmp
Size 414B
SHA256 ddfdb7d50012dfcb5f7d89adfccc0f2b39378000aa27ccc35fa206542a84c976
MD5 3ccb2addf751a25518e39141d4e00b27
SHA1 20f656fb89842a1bad572e98fb1bf36b194d3026
SHA512 71b6ff1821de06a67cc4596155159aa4f98af68a9d226c45036a62694c8c325dca77c415e477e6d12f0c94ded0e94f36206973de70d5bf4f1a2dd43ca1ecc93f
TLSH
T1A0E02B99CC71FC3B1CF9075E60581B86E76013162B51A90B3B3C820E8FB472E858785C
MD5 SHA1 SHA512 TLSH

Submit Download

5ae67a38-d77b-4a1e-b9fd-13e6d5f5f7f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ae67a38-d77b-4a1e-b9fd-13e6d5f5f7f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6f25f0ad2373aa9804e5465f448342deb9b80d25b55fe0f5bb4f6b40bc2bc7d0
MD5 0c918e1082643d62d4953e5cee99f790
SHA1 e26ccfbc63a225dec6489235ebc9434b6ade2e7c
SHA512 50110ad6354690ca0e0ef1c412b5322d0de3cd80077c64f17d71ff9adbe8c1bdfc27fa8959a4cd5abd0545058ce2c5b52d8daf2b19ab7b32b3cf498185878bbd
TLSH
T13E616490532D0BF2C75CCE715CEAAAF8B57588E8038B6E10D77090B8DB123F5A792014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ae76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ae76.TMP
Size 3KB
SHA256 e4b0bfac7a6bf26db7ba8811ae08bd4140762b34641ae04a43a55dca948d0cbe
MD5 75397417fbab1ec80665743178ce0298
SHA1 859c1cf8f09f98197904074b69598ac7ba9edcf4
SHA512 c01d19d483a8e1372ff03deb96a318bd00b4d938076ad5763113f34610ee442c9973cf4e89d2b6246c4a0c5268da14967f4ffdf5fab7a54c92b15018d6704968
TLSH
T1A6512D94032E1BF2C79CDE712DE9ABF8B575C8E9138B6A10D37055B8DB227F4A752010
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 49b7806c40c4b8798f54cc46e1213a3b580632e4a911d0255923e88cb2d584f3
MD5 557ff483d8a08f53b2c0064478b0f0fc
SHA1 59e93935a21c2c26bcce48d1b68819489a337dd2
SHA512 961c14dc8ca882f541cc369f3e091b483a5d11bc07adc8e54c9f7fa44abc41dbbd97918661f26e71d6bac426917a6c14de406737667474439a0857f2097a35ae
TLSH
T103E0865405DDC529D55578A7C3A86B0886D1394AA68F3B06978E88406502746FEDB2C0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 9de92cac71677bf89e07229625274c5e48f0c62be8e46985a2cfe44756e0b344
MD5 597c00c968be57dcc9e5d42286426eb5
SHA1 c3d6454390f9bf1579bee5fdd9b52c1db531914a
SHA512 39fa2c27452a3bb82dce50ec1dff47965182d20f0b01c5b28f9847e78613b84f284189136c255cb1062b1d6d6e54b13922dd67c2a31b8de5609a18f8e580f026
SSDEEP 192:N0K9/jKIcyhmH+bF+UI3iWGVoWN3qL/qc4VVV63:N0K9/jKI5hmIkUI3ijVoWN3qL/qc4A
TLSH
T1D124241F9F703622CD7C51366AEB44A29D6DF03FC753A6CA6C610460DEE3A52A01C5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 41dae1dd839de519d5cc9e63a2899b07280d3a657d6f90b0f7801055eca66837
MD5 8cc9ec2750ade0884a1959f398e901c5
SHA1 6c9acd89fa48742ae0d2abf57f62a00d0e8f5a15
SHA512 04d29348bcf0ec57f279f2b3261a19f459d0c4abe7581a200c1595533c3f8ec59067ffdb72d42e3f1a014cc9eb7dd30980ee8b208fa42c130d8797f7635e12cf
TLSH
T1F861ADF787B0856E9E1196F09A18EF2FDF6C0611431C786989D0ED27D7E34B2E00266B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a6aa929387fe3741fd23eb85482471e69b51ba41ee21422fde65ca1ca4138f29
MD5 9e172c924663e3633625aaa7f43a72c7
SHA1 437b8874b9bc6343981e60817c2ad6023ef4c45f
SHA512 948a5da477b85be34c8251fb4ce60a02af382d42c34734c800530c0160756fe747b504f6249a31a7cdc242693a6c8036e96de73ab6d7c47dcb007edcd62d9a86
SSDEEP 192:sxRKRuHTRf/f5sFWpVhiZnwaK4zoA8p94/g6+WNzwumr/AN97yrqqs6gcIgDY1J:sxRK4zRf/f5sFWvhkqBe/5w/wEq
TLSH
T1A0529516A938A93B9CCBD21DFB557F63D6F85422A1D52E48EAFC8A1C04E76DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 efd34673391de2b0b19a7c00fc9b98be37938c6b2b41b54510234fed3ab79695
MD5 bdb7e95cd9fade7598285d8203faec45
SHA1 a023c720fb1d73847af5b07cd43bccb348233bcb
SHA512 4bdf173575581515e6c4e4ca484d7476376c6a2a7eb8bb1fa5eb34316ad70c168d329d468a0355f758aeadae30d73abf0c3e7179554eba33482dff5fbd9c44d0
SSDEEP 384:sxRK4zRf/f5sFEWvjk4zCBe/5w/35ylqG:s+4zB/f+EYjN/5y3WqG
TLSH
T1ED52B615A924993B9CCBD21DFB557F63E7F95022A1D52E48EBFC8A1C00EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 10ad5720e625f4b9816d17156ac5a4af2b0ed6e68b58d4f91eb72eb6aebc4faf
MD5 0ca8e99bd84de62f18c8dc5466d41dde
SHA1 a4f0371af8a725d334a3dd4aa96bbb61319f1ae9
SHA512 68a42c7ed2b9cecbba23fa24f4db25f6d71b21cf4fa75c5a606bb5f80157127aa145b5810dd15e67c4c85649d27e24b0eeefa07873ec2715999cff32f1b84e8d
SSDEEP 192:sxRhRuITRf/f5sCiZnwaG4zoA8p94/g6+WNZumr/ANZ78rqgsDGcIgV1J:sxRh4SRf/f5sCkmBe/5R/O7J
TLSH
T187429416A928A93B9CCBD21DFA557F53D6F85032A1D52E48EAFC8A1C04E76DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c71f05b5f17cc424f232483e6499d7fa2275c3a17344d78c010e7f6aa9afc97a
MD5 ac0eeed41f4a2195067d453eb8554d42
SHA1 7ab7d236d8af39b3e882c1c880c9e17370572032
SHA512 4a2ba8819227e984e206278a30324b7a15ee04c387ef42d49d79c576e3a12f3453091642300f65f2850733ab60e76fe3e253a666888deed45927b2d3254f5496
SSDEEP 192:sxRKRuITRf/f5smiZnwaG4zoA8p94/g6+WNZumr/ANZ78rqgsDGcIgDY1J:sxRK4SRf/f5smkmBe/5R/O7q
TLSH
T10F429516A978A93B5CCBD219FB957F93D6F85032A1D52E48EBFC8A1C04E76DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 97c092679963ad4ec09baa82a05ee71ade73066c861a3d06a254c61727bdfc2c
MD5 ae147e8764ca035f6a1b1d740d923237
SHA1 90269c2786ec17fa89e4136c2a17d9a0b44495c8
SHA512 663ef50970e28438e3c4aa9821d0a2ad5a20c730047df907db2ee2a4a77fe310808010790e9fd27670e2708252de02afcfee6cce9be4e26641c5aedae9e44cb9
SSDEEP 192:sxRKRuHTRf/f5sFEWpVHiZnwaYzFE4zoA8p94/g6+WNzwumr/AN97yrqqsZGcIgq:sxRK4zRf/f5sFEWvHk4zCBe/5w/w5q
TLSH
T1CF52A615A938993B9CCBD21DFB557F63D7F85422A1D46E48EAFC8A1C00E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b5960d59b11027612639f6fb94b9a8f0702d8802a75c1130dc922cd81b126fdb
MD5 a38823a78034a2458562615e65d83c38
SHA1 87ed0da63e943525871d7daf25f0507de1675ba2
SHA512 f5c38d0fa76047b3b18bf2ab7bccc1497a2e9fca7a36f70b08ca88a9ed8eb63c333b28b7f5217734e7109ffe5d909429988f5d848bef69e0570553fa8596a6a8
SSDEEP 768:ky2S6/S7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwPuSV41ro4+sh:ky2S6/qE7evWgd5f/bu1jaXPuU4Ofsh
TLSH
T191D2DA3B640CCB7F4F804ADDAC197F9E6DA802CB9698C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 6b7f5c17376623939747ee1f96f890429d517b8ba1c62926a67413f6abc968a0
MD5 6c6b9c4f5c676710ce3b69f0aff7b02a
SHA1 b31e381d59cab8104de29c7ff4bf61952b878612
SHA512 a6139bfb074e06ee361adffb56cd1fcbc6eb5fcaa1bf0983194a9260261cca2b52175310163029c8f4f7e040ecc93dddc2f7ecb894009584a206b74ef4f13d45
TLSH
T198E0261056CCC17DA25D208343289B0C93E8791FD2CC3E063F89DC406687784B19B580
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d0b17dc034820a124f72d26a45b0d818546fe293212e86e3cb14404ee7f39bb0
MD5 effecf6d345d0bd8e55d2ec0c993ec28
SHA1 a10227776beba162cefd0d4564bd5ff10758908e
SHA512 f347dd50f3c04a260078a976fee6c00609f8e62e1e3b3d3b04e213f6aa671a89fb49cc9384e31f10843f4aee4a6dc99bbd65b5c9674b622fe7cd0378936647ef
TLSH
T1C5B0128ABB816116CCCE4D770DC44B45E720E09211044843D814CF108C1AB68AF118D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 2802b7f6e5541d7c67ab5a7608bd027234962ca0003feecb6c153e557137c8ab
MD5 c3aa84e5068dcdcdc681878246b30858
SHA1 42abc94324668738696e7ff204f8fd5258866a76
SHA512 c2adcb0f66ca4c17f9264e4c78f5fb9aa1dfb4680cd6d9e38fc58054801ac6fe95cfc82028d767077cdae6f7ebcde0cc504e351b5d80dc7879420c809ae1a8b2
TLSH
T15DE0D8301ADDC62BA296348B8364EB0881A27906E7CD2A152F5D98406207240B75B140
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 a93e50f23c91d416ce1109ffa47c788388b97a1096ff675a6f9b3b19cac9cc9c
MD5 68455db1f81086fdd2de0dc705418454
SHA1 80be07ee3220ba2bd462f197bad9e407817f0f40
SHA512 ef748d0347072b634bfae23a68aacdaa828d699e39ccbefd73e6f3ed29cc6de6d5e2b1563e7bc9aba97998acd7f90536170024e3f8ea20104a3dce61b04943e5
TLSH
T13CE0867047EDC6399B84A0874364FF1CD7F07D1A9BCD7B4B5B4D4890A582244BAA7584
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a8dc8756a68ae336b63b9566be5895010806912f25a812780e0e3134e7a6792d
MD5 f1e29c68cc6c97ccf8937f45df525693
SHA1 f6494ece27573411e13eb17851d0e2668d4d2334
SHA512 7060fec3ad865467503261cc74e453a6ea9d2f430e0f60782f6029b371706592135f1e2c7d41b559cda7d64deb6a3bb3394ca57078bd874c5bff9189e4a67fdd
SSDEEP 24:K/ReVsVIfKZha1KSc3TyXqLRcrIUNX7bxKyEIJK6hg1ySD4sgXQIGI5KUhE1aS5I:KECIfKfa8fyZoIJKsgkMRI5KCEUDy8
TLSH
T13E91BE50307A020138BD390AD295C76F574331BB3458EA3F7BAA04B69A6BF157CBC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 72f2f0fa4139be71b9b9869eb85ddc390a8a57f3fdd3ef9735e848db50faef4b
MD5 a97e73ba4bb41635407378610755d61c
SHA1 34faa1ff11c9443bf78a2e47af9842f65ab85e9e
SHA512 addb7fdb6cb662930cbd6d4c49e44364f8a2e4baf5ab46cdce28bedb486dbf96d7d9cecafdd133c39d335257f35d6c08d9cfecfb871cf0c3115817693bc13604
SSDEEP 384:aQlW7sIIIyVb3sMIMyCi6ypBhCt+s9CspBP8+zcj6+zcjI/pAj:aQHv9bpBP8+zcj6+zcj9
TLSH
T1C572946A96510B33CA6E6F360336C210D3D58C425A62935C38A51C1EEEF3BA7C2D16F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 b2b1650349128001988ec953baec3dcbc7c191e8180e7125ecc5f78d672af64c
MD5 a38ea2279cf1bdf6302f1a5e79f75fdb
SHA1 694a41fba5ed17799bf689a775379be4670e825c
SHA512 4de080c7b2a211c8d996f22e366af1341236185929c9bedba90109783b67d9bb76a8e227461675ecbcd6c77582608cdf28f15ca9e151ec60c149103bcf7dd4c6
TLSH
T1FEE02610AFDEC26EE955209B82249B0882843E0BEA8E2A0A1F4FC444E402240F7DF1C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e88ca2ed25a7fe3cb8d0b524ae16e5d552957be3c2141873034d9ca0e8fd78b6
MD5 e5d3074d7ae81fb3677c2336d125d07f
SHA1 a3366b51279aca7fe0b396af98c9b7b8189aa1f5
SHA512 dd292ec8fa1ff8d947350ab41742f59d6d6e5075ae6a9e203b2ec00ce996b64e7088bafe63305c19f1b4ffd0ee0a7b3bb2ba04f4220be2ba6b68abf623d8d619
TLSH
T10E21D295F330D109E14E867EA47A9B291739E802CFB8EC0F857924746EB6F041E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 53b026abc95122df3166ee16a3f90b48f12ca34be0dd871d7ee135d2186565ee
MD5 d4f38497bfda4c858d2c2e7b54af0389
SHA1 e48f51f3b4ea4c4522552746e4fb7b2379b1136b
SHA512 6136bd0ebceb40e609a929102eed0440fe62f1f082afce1bb9ac4f21f6a75638a1c9150486688f1ef0ebcdaaef206806ce2b13ede8dec25f1c4f36f747213775
TLSH
T1C7E02610BECEC3AFD15120A79364AB4882953D0BEA8E2F0A1F8DCC44E902345F6CF1C1
MD5 SHA1 SHA512 TLSH

Submit Download

c8bb2d4a-5e12-43bb-b8be-09ce8bb57a36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c8bb2d4a-5e12-43bb-b8be-09ce8bb57a36.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6898f462bab409d27642ac4d1bcab550f6f8f9c163a85762a93a3cbba0625b33
MD5 7a5888bec7a174cf9ea887981945c859
SHA1 f014fa3de2a33b3c8c42a03d7ffe18c0b925d17f
SHA512 8025a550e3c67a3101ec3d0ec64a0a670ea93778f4dc1ed3b3fa05a93ab3f50e7641449306366836500dfdc7df8b87bb8203c8a7651a7bf43b630c5a4f1f99bd
SSDEEP 768:/rv+4UNbdq3+XqHLyAAam6aQMGdjWca4GhfB0PeU/:/bsbc3mKmaME6pMH
TLSH
T169F2AE31A87C9573DDB79A99F21B6787BEF421A384C40E84C9D86B0D439708E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a3d38f19fd5baf060ff93a8914c496a75089c8232129e11501ce483eb850dd76
MD5 b25baba096e277a9834da3b356e198f5
SHA1 715295b11883537c06548124b473db56f24861b5
SHA512 83e5fb3e218df1239b83c3cf5426c287e1cd70ffab91f3c682d2a908203a1d6522c12cfbb8a4b69f1e5d39f85a42d33460b3d21aaaf9cb5eaa56b8d99ebfb17d
SSDEEP 768:Ex3INZL1LqAam6aQMGdjWca4GhfejWc3PqJUV:Ex3MWmaME6pUWCPOk
TLSH
T149F28D359CA8893F8CEBB385A61E2693BDF05273D5EC4E44D7DC5B0D426358EA30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 2c3da33788deba98973b3150b31fbfe33025016889072e6c7d8d0aa3ed847d66
MD5 257d4aba5672059893d6e83508a048a4
SHA1 d212785195593efb7038ecdce4308181e2438885
SHA512 83bf2fab2a3039f925e6aec14bd4d5662524515ba184b990efba90cca306996ac2e1bfa63eb2aea9d4982487529db74e93495fcacbcd7d70254418567bc9f6a9
SSDEEP 768:TFIx3awgwpLAam6aQMGdjWca4GhfpcYF9iRBCAZH5f3bhS7d+lhW8jWc3PqJcV:6x3vmaME6p0Y7iRBCKfrxhJWCPOc
TLSH
T1E9434AF998E78A3BD8AE6787533D2D4299BCC163B1985894F7D81E0DCD520BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6287a1c5428f9da3a9b49520b32ef21a6dab05cacedfe20642d3eebd0e7f640a
MD5 09c7e7757e9bb2ec052d1594eebeaa89
SHA1 0a6fe82880d550541ee1a60fde1db4e03755732c
SHA512 facb050a0c84895a7cc6fcc99d73c1b6586735236f90cba44a86be31dd3bfd976571424a11d8ce0fceb29e91062bc2f3bd8b95b47f36391dace6e13182db00f8
SSDEEP 768:2rv+4UNbdq3ILqHLDLG40Aam6aQMGdjWca4Ghfw+PeU/:2bsbc3U4WmaME6pVH
TLSH
T1AFF2AE31A868D9739CF79299F25B7687BEB021A388C80E84D9D95B0D42971CE370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 61c6186465b9fed8c5815e69523c554716a40a300530a6c7c9337893862667ae
MD5 64e0d1ef1f0ad3e19a0a2063e48b5804
SHA1 863b72313f4adcbd0555a6f92e56280f9c79cbaa
SHA512 b4498a754f4aa7f19c8d032b7ab5cebe40147149914d0a322e9939d74136fd9f6b7fa790b248420f7c42042c66b1b642e3e384bb018fd84dd6086a1dbce27d0f
SSDEEP 768:ux3pNqHLDLG4KAam6aQMGdjWca4Ghf9mG986br:ux3p4kmaME6pmV6/
TLSH
T1DEF28C3C9C64983F8CEFB389A61E2656ADA44233D4B85988C7D85B0DC27758DF307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b76ecdae1856fc16349f33b1e22a7ec5a2df290c9e2342e355fe335e24a1dc05
MD5 d7ed04eeb932122a1025bc1c6ada42e8
SHA1 927250cb5f285d28c0365cbd429830db046d7588
SHA512 139ec2264e8b9ba4d1924392d144f4748ec494f5dc15f4023ab96ee3f072cb78ce73c46ecaa9934a4dcd44a74cbdd1a142cb87e72e4a058f4d1537f764c3e44e
SSDEEP 768:6V34NqHLDLG4CAam6aQMGdjWca4Ghf9+br:6V3S4smaME6p+/
TLSH
T152E29E3068659D779CE7A295B76B37C3BDF0517388C85E84D9D89B0E029328E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 06aec138fdbed3a5ea8360cc4cb3738b0f59a2a576be894e4a6b6ff234416f87
MD5 523c20a11c177f1e824618e68c79154e
SHA1 a37d6087a5aa84bdb0bd5135cd7b7a7ae29162e0
SHA512 26debba61468e0836bcf80845435f6bbe1f2830b6a99508eb7e2f435c3f355e97ae99887cefd958cf6b7ed65b15b914dc0b05ac800385eff84f36db3df430c15
SSDEEP 768:Dx3INqHLDLG4nAam6aQMGdjWca4GhfeAkV:Dx3C4BmaME6pdU
TLSH
T106E29E3168649D379CE7A295B76F3687FEF0517388C84E44D5E89B0E029328E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 398fa3ed8e441c7e74ef9b5a95969882679dab190e7f82b9ffabc599fe4c0836
MD5 db1b4e3439359cbb4a818f4b70dd5858
SHA1 38fba41a863213be0a75de34868eba751a427810
SHA512 e30032c034744c123e87c9536b0df59a26e4704a09826e2c2686143eba04211b30d8be6b25294ac14de7dfbcd113b9dae6e9af50424f36f47dd5010eabd4305e
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3iscQQtydOzcQAJmdk:TL+j0afDdWec9sJVUOvp2Vjy
TLSH
T154920F22B9312073ECDE473ABD9349E00EBC175EC9A7B8548ED40C2209B1BD2A2491FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6287af6581090c3c6a8e1483c44bb5d10557e57351af2ddc63e3cb94e5d1fc1f
MD5 d71512ffaca4f68f3ea9a011b0d61ba4
SHA1 e6a108386c43f33be719c22b132cad297dc50123
SHA512 4edf4589d7b83496bda54e88a8334e9eaf9cf383bf122c9d6fa5447d2eabf0072c97c34846a0b91edcedcb0465dc7685b1ba94df81817d50e48af988eca958f0
SSDEEP 3:MsEllllkEthXllkl2zEflT:/M/xT02z6
TLSH
T1034404057FC00515CD4050714053C3517770D4300511DF4334D504335CCF7404C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 522B
SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
MD5 b809bb2b4dca57c6dcf6e141ab343c71
SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
TLSH
T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 1KB
SHA256 bb690274725e366d951d3462e40f4b0ddd639e2b51fbe51942bc288805d710fe
MD5 63fa4afc22fadb1f270ae63305728e9f
SHA1 ec77c2799a9e9c231a0e28ceb675c2bb0e623b2b
SHA512 da56637eac06bb2acdffc9e65cc01c41b1d527045adfa75b430393e6625764d5a11513da583c6ffee9932102c4962259759f69c7ed1bf014a31e221b8293ed20
TLSH
T119310BAF5066D5E4C639A13C05B92B6671A33CCA2490713F14730741FC35BCA9C48D7E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

04e67cf6-d202-4b51-95fd-7b64366fcca9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04e67cf6-d202-4b51-95fd-7b64366fcca9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910185146_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260910185146_000_DotNetHost.log
Size 4KB
SHA256 996f1f67eb6f81d27a5e7d61d8372aa8f946e4dfa781231b34d47019ac650408
MD5 9d01785a3cdb7c7bb14f32435b3bee24
SHA1 e992d87ce7cf0d5c1cb3a3436b9a7db0cfeca535
SHA512 dfc4e655689cd8e835cda9c808fc7373a0a994c5ed129d03bc40ca807cce84e8821dc413a32411648ab37a192c988a99f0261a52ae121484dc24470d986020e0
SSDEEP 96:Y0+aQPMT8qc8caONY2mqAfZic8iOZc8PRKKFM0:J7bOaNKFd
TLSH
T12D814D191AE80955B1B75747DBF7C0656A33FDD65830CF4C238A4219066BC02A87CBBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3664_251812467\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{64115939-14AD-4C58-93DE-B609AE4DA102}\DotNetHost
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{64115939-14AD-4C58-93DE-B609AE4DA102}\DotNetHostFxr
Size 920KB
SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
MD5 0dbebff80e13ff5ab5de800e763e5b37
SHA1 e044e032e89bbdededce81d655ae84e3123d367d
SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
TLSH
T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{64115939-14AD-4C58-93DE-B609AE4DA102}\DotNetRuntime
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{64115939-14AD-4C58-93DE-B609AE4DA102}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
MD5 6712931c838d7173b4fe90e26cf3b44a
SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
TLSH
T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAE38.tmp

Path C:\Windows\Installer\MSIAE38.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{64115939-14AD-4C58-93DE-B609AE4DA102}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{64115939-14AD-4C58-93DE-B609AE4DA102}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download