hxxps://gofile[.]io/d/pVY9iG7C

Analysis

user interaction
yes
max time kernel
695s
max time network
696s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/09/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/pVY9iG7C
Sample260912-s8lp3ssvfv

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
183	4792	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.12-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.12-win-x64.exe

Executes dropped EXE 7 IoCs

pid	Process
4432	windowsdesktop-runtime-10.0.12-win-x64.exe
4552	wixstdba.exe
4148	windowsdesktop-runtime-10.0.12-win-x64.exe
1668	windowsdesktop-runtime-10.0.12-win-x64.exe
4932	windowsdesktop-runtime-10.0.12-win-x64.exe
1740	wixstdba.exe
1564	windowsdesktop-runtime-10.0.12-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
4100	MsiExec.exe
4100	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
2176	MsiExec.exe
2176	MsiExec.exe
3792	MsiExec.exe
3792	MsiExec.exe
2912	MsiExec.exe
2912	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
2548	SentinelServer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	api.gofile.io
31	api.gofile.io
26	api.gofile.io

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2548	SentinelServer.exe
2548	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.InteropServices.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID0EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a77c1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93C8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI94E3.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a77c8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E358F0F7-0226-419D-85E6-D45A08BF195F}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a77cd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{902710DF-F5E0-42EB-8959-ECC10CC368DF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI967A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a77d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB502.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC68A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID081.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5a77cc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB167.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8FB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a77cd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA32D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA83.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5a77c8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a77d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8668.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a77d1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}	msiexec.exe
File created	C:\Windows\Installer\e5a77d6.msi	msiexec.exe
File created	C:\Windows\Installer\e5a77c1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5a77c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD43.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\ProductName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2939A0641A55C25433FD7E322A7159A9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\ProductName = "Microsoft .NET Host - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\PackageName = "dotnet-hostfxr-10.0.12-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{902710DF-F5E0-42EB-8959-ECC10CC368DF}v80.48.58476\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\PackageCode = "F51312C54E22CEC4182D8D57784720B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5840E2420625E5A4B03C0089F5778860	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{17D94539-A423-48D9-BD4A-69A9186C5B66}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Version = "1345381484"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.48.58476"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{17D94539-A423-48D9-BD4A-69A9186C5B66}v80.48.58476\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\PackageCode = "A67E422DCB5A6B244B1F3508AB24FAC5"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\ProductName = "Microsoft .NET Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Version = "10.0.12.50000"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)"	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe
4664	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	4664	msiexec.exe
Token: SeCreateTokenPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLockMemoryPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeMachineAccountPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTcbPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTakeOwnershipPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLoadDriverPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemProfilePrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemtimePrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeProfSingleProcessPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncBasePriorityPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePagefilePrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePermanentPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeBackupPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeShutdownPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeDebugPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAuditPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeChangeNotifyPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRemoteShutdownPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeUndockPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSyncAgentPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeEnableDelegationPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeManageVolumePrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeImpersonatePrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreateGlobalPrivilege	4148	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4552	wixstdba.exe
1740	wixstdba.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
2548	SentinelServer.exe
2548	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe
1700	SentinelServer.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3964	4132	msedge.exe	81
PID 4132 wrote to memory of 4792	4132	msedge.exe	82
PID 4132 wrote to memory of 1580	4132	msedge.exe	83
PID 4132 wrote to memory of 1580	4132	msedge.exe	83
PID 4132 wrote to memory of 1580	4132	msedge.exe	83
PID 4132 wrote to memory of 3908	4132	msedge.exe	84
PID 4132 wrote to memory of 3908	4132	msedge.exe	84
PID 4132 wrote to memory of 1560	4132	msedge.exe	85
PID 4132 wrote to memory of 1560	4132	msedge.exe	85
PID 4132 wrote to memory of 1560	4132	msedge.exe	85
PID 4132 wrote to memory of 2496	4132	msedge.exe	86
PID 4132 wrote to memory of 2496	4132	msedge.exe	86
PID 4132 wrote to memory of 2496	4132	msedge.exe	86
PID 4132 wrote to memory of 3252	4132	msedge.exe	88
PID 4132 wrote to memory of 3252	4132	msedge.exe	88
PID 4132 wrote to memory of 3252	4132	msedge.exe	88
PID 4132 wrote to memory of 960	4132	msedge.exe	89
PID 4132 wrote to memory of 960	4132	msedge.exe	89
PID 4132 wrote to memory of 960	4132	msedge.exe	89
PID 4132 wrote to memory of 864	4132	msedge.exe	93
PID 4132 wrote to memory of 1804	4132	msedge.exe	94
PID 4132 wrote to memory of 864	4132	msedge.exe	93
PID 4132 wrote to memory of 1804	4132	msedge.exe	94
PID 4132 wrote to memory of 1076	4132	msedge.exe	96
PID 4132 wrote to memory of 2724	4132	msedge.exe	99
PID 4132 wrote to memory of 4172	4132	msedge.exe	100
PID 4132 wrote to memory of 2724	4132	msedge.exe	99
PID 4132 wrote to memory of 4172	4132	msedge.exe	100
PID 4132 wrote to memory of 4172	4132	msedge.exe	100
PID 4132 wrote to memory of 1132	4132	msedge.exe	101
PID 4132 wrote to memory of 1132	4132	msedge.exe	101
PID 4132 wrote to memory of 1132	4132	msedge.exe	101
PID 4132 wrote to memory of 2880	4132	msedge.exe	102
PID 4132 wrote to memory of 4152	4132	msedge.exe	103
PID 4132 wrote to memory of 4152	4132	msedge.exe	103
PID 4132 wrote to memory of 4152	4132	msedge.exe	103
PID 4132 wrote to memory of 2104	4132	msedge.exe	105
PID 4132 wrote to memory of 3444	4132	msedge.exe	106
PID 4132 wrote to memory of 2508	4132	msedge.exe	107
PID 4132 wrote to memory of 1224	4132	msedge.exe	108
PID 4132 wrote to memory of 1224	4132	msedge.exe	108
PID 4132 wrote to memory of 1224	4132	msedge.exe	108
PID 4132 wrote to memory of 4080	4132	msedge.exe	109
PID 4132 wrote to memory of 4080	4132	msedge.exe	109
PID 4132 wrote to memory of 2916	4132	msedge.exe	110
PID 4132 wrote to memory of 2916	4132	msedge.exe	110
PID 2844 wrote to memory of 2896	2844	SentinelServer.exe	116
PID 2896 wrote to memory of 572	2896	msedge.exe	117
PID 4132 wrote to memory of 2448	4132	msedge.exe	118
PID 4132 wrote to memory of 2448	4132	msedge.exe	118
PID 4132 wrote to memory of 2448	4132	msedge.exe	118
PID 4132 wrote to memory of 776	4132	msedge.exe	119
PID 4132 wrote to memory of 776	4132	msedge.exe	119
PID 4132 wrote to memory of 776	4132	msedge.exe	119
PID 4132 wrote to memory of 1484	4132	msedge.exe	120
PID 4132 wrote to memory of 1484	4132	msedge.exe	120
PID 4132 wrote to memory of 1484	4132	msedge.exe	120
PID 4132 wrote to memory of 4172	4132	msedge.exe	121
PID 4132 wrote to memory of 2796	4132	msedge.exe	122
PID 4132 wrote to memory of 1880	4132	msedge.exe	125
PID 4132 wrote to memory of 2832	4132	msedge.exe	126
PID 4132 wrote to memory of 2832	4132	msedge.exe	126
PID 4132 wrote to memory of 2832	4132	msedge.exe	126
PID 4132 wrote to memory of 4432	4132	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/pVY9iG7C
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcde18c188,0x7ffcde18c194,0x7ffcde18c1a0
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,17106643703332450992,12084485750486898372,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,9522378746147183193,12836236043837466910,262144 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,13301536852676412440,3708150751413334851,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,17790866260169980879,12977709030951543503,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,11886731538977496328,10902493509136660733,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,3229609477804679744,5478825697588221836,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,490038999540402503,146752277226390868,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,13474294004672178039,9271617203034230896,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,18232209753172556516,2304411765895500121,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13541613011477318918,18222496249262713324,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13541613011477318918,18222496249262713324,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14536714452106939399,17555960144963549553,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6364,i,1573786841463788226,8035295867277495632,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6832,i,15971108587241721655,15161607913760417376,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,1965970013723564854,15091185423188910987,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5796,i,3441321528780081140,13768301853057579117,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,17333832381652554544,3917697582346785990,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,12779872977306851326,9260626351733191779,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,15629551422664739060,18251929267947917260,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7492,i,12211678618597074192,13397628038871498704,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,15756507796844061733,1523293167039084831,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,11622303378909096352,2430971519223304513,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7124,i,1065494138046788149,9271286342984630865,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5532,i,9312457815081999873,13978383385739135385,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6544,i,9704331059155992597,16502765962232947152,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8040,i,6527124002673272834,8578004855986588599,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7144,i,11096700317634915601,12204581307389444896,262144 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13419760779612770463,756335377691665410,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13419760779612770463,756335377691665410,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3524,i,2458141865768787368,921299996490784086,2097152 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2832
- C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4432
- - C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B3BECE29-AC92-4443-B483-264646358F5C} {9A5B4E99-1DC6-4040-BB85-FE3F2730E285}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4552
- - C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{BDB79B0B-8C37-4A94-B387-0F3918E4CB76} {D3550DCA-F1A0-43E7-84F2-1D1E875ED98B} 4432
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,6098382866043483171,5096937316803903208,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10897185685058303248,13523190797974095075,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,1780204626743584190,14813251842930683353,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,9621810404481511886,3663394475100244988,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,12620950974705072432,17051952784583681178,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,1533270344431702266,7009509492282930947,524288 --field-trial-handle=2316,i,6322316961898159690,17514842396042569652,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4360

C:\Users\Admin\Downloads\Sentinel 1.0.6\SentinelServer.exe
"C:\Users\Admin\Downloads\Sentinel 1.0.6\SentinelServer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    PID:572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 63B883A22525A654E4E3F7E2B3A0E2BE
  2⤵
  - Loads dropped DLL
  PID:4100
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 331BDD8DDD6200675488CC19815D5CF6
  2⤵
  - Loads dropped DLL
  PID:664
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7EB50377DE09E8636E1EC15C558618F1
  2⤵
  - Loads dropped DLL
  PID:2176
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 91267E2B3B65241EDCA573C41B909B69
  2⤵
  - Loads dropped DLL
  PID:3792
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 059108F57501BF8A4CE35D3F3F6BDDAE
  2⤵
  - Loads dropped DLL
  PID:2912
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D6947D0D8F4709023AED7463F53D38CA
  2⤵
  - Loads dropped DLL
  PID:2020

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1668
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4932
- - C:\Windows\TEMP\{CB931455-FC28-4E45-9DC1-B117BC6CC571}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{CB931455-FC28-4E45-9DC1-B117BC6CC571}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{BC78C6E5-7879-4B92-977B-C017DDEDFE44} {06471F5A-F4A8-4225-9571-769DA702A933}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1740
- - C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{3602731A-B135-4307-A13A-0B16B0E1C5E5} {B2D03527-1897-43F0-8EB9-65B15E3A3675} 4932
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1564

C:\Users\Admin\Downloads\Sentinel 1.0.6\SentinelServer.exe
"C:\Users\Admin\Downloads\Sentinel 1.0.6\SentinelServer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548

C:\Users\Admin\Downloads\Sentinel 1.0.6\SentinelServer.exe
"C:\Users\Admin\Downloads\Sentinel 1.0.6\SentinelServer.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a77c4.rbs

Path C:\Config.Msi\e5a77c4.rbs
Size 11KB
SHA256 578c93932d568ee929c7a65d8264e1e23128fc3fbfa038af6bcf1adbf65769d8
MD5 da90d7a681a129c376ff6efc993581a3
SHA1 a5ba0bd6b4a0058878b4d919878272c025e28ff5
SHA512 efe8e43de6b10c595482645fb3bc45111d19274fef9091297eb5d0b8d693c54d28b743a97a5495b9eee9838fb6fab6b919cab2687432022fc835f54edcdec940
SSDEEP 192:tKvwTCNyabltc/w5HPSX/eT5tKnIltKn7jEy8FCPePp/K:tcwTCNyahtB5HastKutK3W8
TLSH
T105325291660182D3E9962B74C70F2B357B73D2DAA348679F09CDC1245F273CA0F6419A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a77cb.rbs

Path C:\Config.Msi\e5a77cb.rbs
Size 9KB
SHA256 333fffbdb5a64fefbbeaa0626620081508c3900a0053c009a2c51caa6ead1003
MD5 5dd0eefa9d2e6fb47b7777268f0dfe2f
SHA1 932d749cc8380df4d9fef20bd6ad9a147db197e8
SHA512 d340db32c3b51c822d2cc2d313c50ae4a5639748526a5d99cdf184a19752c4f76551945474bcea887244bdb97badbefc5f49402da6ba5d5b2a07bcd4d82881f4
SSDEEP 96:Nm0B0yiChrE0NeW0VGULUeD2KPKACsTlHULUeD2KPKAC6jfsQnUTl+nKLE5t7J/d:QY0Sjel5TKnI6TKnjZEHRvaePpx
TLSH
T11212200166048BD3F9A26B38DB1727743F76E3DAD214179B089C93748F0B7891F6A19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a77d0.rbs

Path C:\Config.Msi\e5a77d0.rbs
Size 49KB
SHA256 41b402fabbfe325cd6f49b50b7dac8c4459142fb9bf5fc1f504d8021150b5916
MD5 8987657a4f9750fed4c3636d17c38203
SHA1 efa13cedabfff369c2a7bbedf9e22c4b1b0584cf
SHA512 f6572427414adecc1575c93cba3b57277221e5778584e999ef553a042ca268ee8885c369dacaaf955b60362e011806d6cc9d8bceee63141ae5dbd4ce30cd238e
SSDEEP 1536:o4OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYeL:y6/l
TLSH
T145331E38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a77d5.rbs

Path C:\Config.Msi\e5a77d5.rbs
Size 71KB
SHA256 16d79b3f0fddc10117adcf7acaf0b456c14a3a421bdba81491eebce80ea3e6a0
MD5 edde4fcaffc173f7e16b2e5d891bf3a8
SHA1 88df82f74e915e624dff4dd0c4edbab882ac64c1
SHA512 384a6ce62e48d51bc5acd54d48428d0c88f8f2a38cf36b96739a2ee1c21d714d44827517831f961bdb0abf746c45cba0abbd4559e7fe66eecb289e07c3b7c220
SSDEEP 1536:u+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdWS:Dh0Z7Aj6s4Se9eIOm0i6j
TLSH
T1C963DEEB5610C5C1E8322A5813FBFE48AAD9CD67B344463D00C5332ADEB79C6DF68991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a77d9.rbs

Path C:\Config.Msi\e5a77d9.rbs
Size 3KB
SHA256 39d600a873d54c5a42f8411a9e547628d0b8f9b331cc5d33169454bc05d687b1
MD5 807a4ea7e878b0995a1edf1a5515b22b
SHA1 f8dbc31a1e50d6573e554affcbd44088d8209db1
SHA512 d036fb1cb983c4ab148479cc81f6d907c453c1f405751ea8c0be0a32473437384784356d7800d9944d03dd429a4827b04acd763e50f98298a4e323eac534f5f1
TLSH
T18671BE02DA40C6D3DDA22B35CE271B6133BBD3DA9724878705DCA5340E4778AAFE9246
MD5 SHA1 SHA512 TLSH

Submit Download

e5a77dc.rbs

Path C:\Config.Msi\e5a77dc.rbs
Size 3KB
SHA256 65f1154ab7dc4a2d528ee1575f430d1782e31556d8a9ebc10951849d03e68aa9
MD5 f019683b62e8f4f179fe952f94660c5e
SHA1 21fe0688ae02c5815a2c4d30c9d4c3ce1c6d892a
SHA512 371570e42b5e278b034d0beb2afa2f702046f33921d2c41659c01e581efaad48e103d92faf2be8074307212b6b737c4b8535a9e2251cae70faacde90def55bff
TLSH
T12181BF43AA00D6C3ECA31B34C9171B2173B7D6D7A364434B10CC92714D57BC69FEA586
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
MD5 522dca4be4f99d21ad35ebc3bb24a066
SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
TLSH
T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\state.rsm
Size 1KB
SHA256 24c268e18fe2fa61b9bfbbec2d225fd38e22f293041cb50f40dd503a0d1b8828
MD5 04262cac692c70373b5c576a90c78848
SHA1 f7033084aebcabed10adc9ae1009d7b9518e8353
SHA512 7e67a7d1bc66b427f121fda5840e5938a40c7f3b99a03842a3041aaae213fba6e17b824d8ea2312c9fab1c8f554d206faa38eb1b3298352e8827dbd847a12627
TLSH
T14921D1515BF6092CF3F6AB3469F96625443BBC121C20C16E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

10d3caea-cab8-46bb-9b87-f397239cdc21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10d3caea-cab8-46bb-9b87-f397239cdc21.tmp
Size 18KB
SHA256 ebdb9c4a62aa782f1ac2b18c92177028169f42df404c1a230cca9776d1739493
MD5 e3dddc0250fd5dee07148a410946f026
SHA1 aff63a2a0c04c74310b83089d276fbf0ea018d7f
SHA512 a880bf7366f9e00fb9b4cc2053703369dae669132df967e3fbc757f465a5217caed3655424748521ad326d5e4b905716d0cac0c0d519063549e05d8f09dffa00
SSDEEP 384:GZcImsNyAOTHO0lapzbmx0BP2BqpXItxT+rXCYo1hrrsa+VYad7UxoT:Umjla5K2tHBIjuC9hrrhgd8E
TLSH
T19A926D36AD78AC7A4DE793C5B54736039EB49467A6CC2F908AEC5B1D00DE29C030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1c4b8cce31539f0d5bcd84945be8b47e4a7d8e745906a0f2c3136a815024ced
MD5 4df6d93c72b0b35ea429d00fa8d44c4e
SHA1 14b26cd574a47394e17afcf3b1f8539382eac18a
SHA512 bec1a58cd64bb4b95c2d295eb2181678e3a5c466fac5119b0c0273c3ef793de019b85323832613dd188b16138c66bf6bdcd8beb7144c514703189f99cd831b63
TLSH
T17CD02B988DC48561E0223438403349053349A4408D029093C1B10339088018204504B8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7151f70a488efbce3d8d739a772444f20cb6a1ab3ca6bfbc3b269ea0535e48ec
MD5 3e729d9d2671674f3bfd818755ef402a
SHA1 3a2a8608ee6c0f8b397447816a250a15fe9bd66f
SHA512 d898a2368beba75703ead1a291c199153e41c8eb12d7aaa2fa01f99dd0bdf61950f4b55199f38ebc728b139d91a778299ce88c18c63bc0d298061cc4554fc1ac
TLSH
T18ED02B984DC48961E4223438403249053349A4408D02D193C1B1033908811C204504B8
MD5 SHA1 SHA512 TLSH

Submit Download

76b9dc0c-3daa-45f4-8520-2dd43b0e1256.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76b9dc0c-3daa-45f4-8520-2dd43b0e1256.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c31c34b2c9d975ea758e538db56bdc5611165baa48c5c99b9db28cb24c45de9b
MD5 3ca7c3098e43427d2178a33950941653
SHA1 8b7704d9f6f8283bf2ed57ef86c375c8dc74a22a
SHA512 56f93a2eab57a0554e75158f79a8f9e73d6318da41ad8541a0605402233e2de04fb0715526f6709344324eacdd669b17746ff85e2d42a75e811180ff6fcfab7c
TLSH
T1F6E0268C44CEC22EB74874CB81686F0C9280370FD3CC6A8E1709C5877202B50F282791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6f2b1ae89b61f0008a44184264b0471fe58ee7ec11ab50c3d61393c34bb058e7
MD5 238e9e149c1aa6b47d48c8d9cfee1584
SHA1 1af18a1e75d2abfc0cf1b6d9c98d8e750e5b1afc
SHA512 c0aaddd8ee8d3a5340559528629272920330c01263b9e30205bed7fa6c2f4e4286b8b48b302cdfee18fc2140b1061d69e084c0fcd180e2fd9c9c9f4cb14c225e
TLSH
T1D2E07DEC15CBC22EA340B6CF42A85B0CC280375FD3CC7E0A174C8DC5B006A68B2E7690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 98fe064c20fa7d142300402a2264315eb2c83ea161a0b27b18509d1a5aaac44f
MD5 ced3cc53e65d2e46ae81160704c6e89d
SHA1 b4f6728f0b35f5cd6ab988c08ceee6a5ec5b38da
SHA512 585d8768962bc34d81c63a8f9d4fcebbfcd34ee3d91f44a99ae8c007b80e5a8f783c55f8c7ee9e99f869ebc4eb63ec3c89b4ac17f3195b4514e97921f14bce02
SSDEEP 96:Z4Nu1Vd0kRCjx/2MGt/dHnnzrgZjTaY4wrhX:CGvw6nz0FN4w
TLSH
T11CA184D089F4AD0CEB34827335E12B6EB930426068531BEF28BCC2693F977D56181B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 79985cf8ceb3c73f6dbba9ea4564fbcd2330df022e68c1358ac54aea3d826111
MD5 489102e461f54510a9ba3c83bb7d46f0
SHA1 352a2ca3fce5e17330a4ff7d4fb2086e66b5319c
SHA512 4a98396348a7c984ce6b026aca45d42c294017439cd4acd270dab8577c1ea1aa2d3db0de1ce54704479b3b50ee4062d73660008a48f6ce974a75ac7b1dda2f25
SSDEEP 96:e4fusVd0kRCjl/uG1/xHnnzrgZNaYCEh4:d5vwbnz0HN2
TLSH
T177A197D089F4AC4CEB34827335E12B6EB934426128571BEF28BCC1687F977D56181B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e9de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e9de.TMP
Size 3KB
SHA256 e8ce8019c93d155407cfe4d166b96c61c6cca394dad494608d9aa8b8e14867ec
MD5 caa6291475049b6aef63d8d2c9d1aa39
SHA1 10e8c773cecdf2eecbe98db51c74b88fe24472e8
SHA512 980bdd235d90266056b0fa87ac3138a08e58e9f9926e0fb5115c1e0d5c73b205a951e2d0f88869dd385697271a96ceda334196a4025fa6c3301c59bc3d7dca4c
TLSH
T1A36182845AA28D9DC7B9037092F5239FBA349581648B1FFD21F8C5387F17763B091B84
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 639757273d538a122ba8de04a54a81239be180f369275521e7c54333a01ac14b
MD5 a90ded0cf021f1b2a9aed07272c4dfc2
SHA1 43663e4ab2cb9c5ae14c781ff3ad1e00450b526b
SHA512 81fabb5cf775da903cc0a10c396ca1255313727fe1d6456f31b016bb98a71f74061ab57c024743dc208a948b4354fc355c525f4910bad1412e49c20b883f5a71
SSDEEP 96:D4OqZefzBS+yPGO5rcAztBMBPBGBMBwBKfbLBlwd3Adf/jHD7x:DjqZef1ShP75rcAzr45e4kKfbdlG30f9
TLSH
T15FB199F783B5856EDE2196F09A14AF1FCF2C0152436C386989D4AE17E3B3462E14279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ea6bbb4f470b7a591950d804b71e59748d7d22b4dbae7f18881188b942d787cb
MD5 986274ab2e09aa543d5e958dc604913b
SHA1 3a581675340bbd08ec2634d4f9520c34b9af97c8
SHA512 b7bb26a046dc2e69bd8cc53894a747cb635d577ba7350e378d8ccad0acc670128f5c3a1afa6835858cf41ac773b8861c679222551dc58b5f5ea06fb6a098d6d6
SSDEEP 96:D/O5ghCzBS+yPGO5rcAztBMBPBGBMBwBKfbLBlwd3ABG/HztjGj4/3:DW5ghC1ShP75rcAzr45e4kKfbdlG30GZ
TLSH
T133916AF74371856EDE11A5F09E18EF1F9F5C0152436C78698AD0AE27E7B3462E002B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0715f54b6028c90437b976d66f31851db2fe27d71f79e5d073fe99faeb69cbdf
MD5 a7d00c0bb7a13c2d400dc235cce547a7
SHA1 a10c35d9afbaa176ceb843f944825ca394c97a97
SHA512 a2ef56c70f63ef640cde28f34862bf3582efba4df27797917d01441bbd519de9f82d981a49cc293b9613406bb32d0da73eb89e892a0c10910e36a6b8c5255dda
TLSH
T1607179F3C3E6826EDD2196F09E146F1BCE1C0552836C3D5989D4AF1BA3F2861E151B8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 142b0294c6ee233f81821e3ece2daa85004a77d0e96e93c313ef8814f2cf10d0
MD5 f85b94cd41b503219a8c4fcdccf98280
SHA1 3a6322b56ad498e10885c5f941d1331a428a6b6b
SHA512 dee43c4403380f5f192fd5f9235868fe1186c72539410c6992c46c2d6e1c2c80585269cb251e3258328434470b9856784b4877edc002fe9db2756642f0b04305
SSDEEP 192:sxZoRwMP5/fcXsEdSV2fedpjl6HW6+WNet7/YLzCDIgrJ:sxZonP5/f+sEdLWEHbg/59
TLSH
T1E022A6566E28A57B8CC7E20DBE25BF53E6F9503291901E58E6FC861C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fe54fd3fca2b8a24380e91a9e75a83b7048aab09e2a87f83b8330dea2ba73532
MD5 13e52a429d7ba1dc9b5005404e1abd61
SHA1 502ed5c19a21fb3ee4927ef87b7a22e12a3420fd
SHA512 e0e3e3c1d2a1afb1eafbee85efaa023b6a063768fc0d8de9704ece5e1d2b8dec7d9beb87de3237d96d13f5728c1e544471396d72c196da15bfbc07413e951662
SSDEEP 192:sxZoRwMP5/fcXsWdSV2oocdpmql6HW6+WNIrt7qP9/YLqCDIg5bJ:sxZonP5/f+sWdLoLOHbe0/qz
TLSH
T13B32E716AD34697B8CC7D21ABE15BF53E6F9103295D01F58E6FC8A1C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 de19362adce8af5f6046defd7485b85a835e7be651218f3d3a68a2b0f11cc9ac
MD5 20609a1b898a52b33b2415f846268798
SHA1 ac6f0658ff0029d6269ba23fb3a64831f43992d6
SHA512 31cdfb85534174c929025b1cce8cedbc8010a63bcab1abd430ce2be0e05b578bd311a9dd1768712986094701946eb1e03e85592e9d13c3dd1b55c3537423118f
SSDEEP 192:sxZFQUn8RwMP5/fcXsWdSz2aobrsdpmql6HW6+WNIrt7qP9/YLNCDIg55J:sxZtn8nP5/f+sWdxa6cOHbe0/Jl
TLSH
T16052F716B924297B9CD7D259BE16BF53E6F9502299D01F58E6FC8A0C04EB7CE1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bac1e82541df609b87c470493e051ce48ec608b5a559374eb1fcc55d08d07842
MD5 b1f8237fc24879f23e92f56566c4b8c8
SHA1 4df9ebf710ee9d977a4329eba6ced8a418eeafd3
SHA512 ad247472a2be493de15d252179ca86e5848cb03113fc45e09f080659a858e4d6b24b4e316e1b75dcdac43031db579bae0df3f2b3a9a0921f6a216db622b46ed6
SSDEEP 192:sxZFQUn8Rwn5/fcXsWdSz2Tobrsdp4qlNIHW6+WNIAWkRt7qP9/YLh9CDIg5560z:sxZtn8I5/f+sWdxT6ccHbD30/luw
TLSH
T1E662C7526924587B8CC7D659BD267F23E6F910329D905F4CEAFCCA1C04EB6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f636e691c2dc09a01d86bcc88c117134a8af38cbc25d277178da127329224a25
MD5 8c7e590c4f385653073665216370fbe8
SHA1 5dcf71ed5d749f883c5864ce901cdddb7a47a79d
SHA512 12128591f9a624c39ddd53db0d206eca612f31d374a28bb8a1aa0f80ecb74d7159f54f337e09754c283fed524545d43b9daf53610d27bb3f5026f5e71b4e72c9
SSDEEP 192:sxZFQUn8RwMP5/fcXsWdSz2pobrsdp4qlNIHW6+WNeaAWkRt7qP9/YLwCDIg556a:sxZtn8nP5/f+sWdxp6ccHbo30/Euw
TLSH
T1BA62C752A924587B8CD7D659BD25BF23E6F910229D905F4CEAFCCA1C04EB6ED2207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 4e9a903834840c394efc946293a7d84652346872b4272515e4bf65456318f61d
MD5 f51321aff60da56a5def79b31c4f4989
SHA1 c9b73364518e062a04f7a8a57a00fe9298beb17b
SHA512 6dbf2a57f0aaf2277898b731e172f2a39efeb2be15600c690820268018f65751bb41776d38bcc6ad1e7b7403792c9b48edee82290864401b69f861afd281396d
SSDEEP 384:sxZtn8nP5/f+sWdr66sjqMpRiYnazAW8pZS15posJWeT+Zp6ccHbo3JX9uw:s18P5/f04nnc7WeT+Zp+Hb8Mw
TLSH
T1D6D20905A920C47B9EC39D19683D7E33AAEC506259C5DEDE5AECCA1C009E1FD6B07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 72515a1f3e2a0e32770f026a95bca8e7e3c0c95092c766176a85e4dfed6060d1
MD5 287312e864d9fa5c746a342da5971c36
SHA1 1142241655424c0873f4210d7e94823ad7f596a6
SHA512 7f6888b199bef9ada2001301276a12def689a69bdb41213db90672fe9845f76517977dee6efd1357f693595d5de80d4cf81e42ebd94ec8aec9d54540a465816f
SSDEEP 768:kwS3ELCWvWGcm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV79Lld/u7Xro9WG:kwS3ELCWvWGcmu1ja+9Lv27EQG
TLSH
T1CCC20A3B640CCB7E4FC01A9DDC5AAFDB6E9C02C7A6648D4047FA944C02D77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f3e2089-d03d-40e5-9fda-5dae9aae25d2\index-dir\the-real-index
Size 3KB
SHA256 d5eed5c7f6ff01d2687f3f96405cb59e4ce69db8cece26b0a434e38b34dd3a7b
MD5 de163da7db093608c2e6a3110839e27d
SHA1 cdb4817f4a755dec6d5c1f6d8e9cbe4ec2c1c80f
SHA512 ce7e846f4e78c787c0be864a69dd9c0ef428591221edad4f00093142f2b6cbf9d7d7b56ed19be5c169b619c126d109a749e2060ce285e36c53b770bea1defe15
TLSH
T10351B54E0D071B1BDD98527228791494337815CC13545A1FAAFD953CF8C3B685DC9B68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f3e2089-d03d-40e5-9fda-5dae9aae25d2\index-dir\the-real-index
Size 2KB
SHA256 404cffb9cb6b3613d4530b0dbbf86586485f42ad533b619c48c935dce86f0b77
MD5 a1695c71018661e57ef4ea82801d54de
SHA1 c73c44bf8f50f776487f13f45e1dca8f5160627c
SHA512 b1414add2a11f99182f984c6e0394144aa911c92d7d8e93116c4bf553088940cfd2e120cad34eb090a7be7e0f4ec95444c4ce0f03cf939f7ea81f1db7093e8c5
TLSH
T12C51D64F4D071B1BCD9C52B228751484337825CC13542A1FA5FD913DF8C3B286DC9B68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588fb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f3e2089-d03d-40e5-9fda-5dae9aae25d2\index-dir\the-real-index~RFe588fb8.TMP
Size 2KB
SHA256 718a19c762023fe924307cf21db430baf66383afddb4061e9c8e1e1509b9035d
MD5 9f5d149285010d26eaacf126c814f7f8
SHA1 5966f88576190b89c9675413ff1c16253c6a74c3
SHA512 56d67667250d12063e87f0fa3e9e4458b05423c82bb4a42c554e34e2f9d53e53c37265da6ed23b572fc682beb81cf4e522e0f23c4a6aab75492335dbf99f70de
TLSH
T1C451702A5D624739D88412B309E96492333AA64887482F0F71EDD136F8C27ACBC596A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\94f5f36d-dd83-4973-9273-10c1cc8ba31e\index-dir\the-real-index
Size 72B
SHA256 65a48bb527602ef4b398f5fe1494dcdb0eebd0086318fb02cabbd17757609cd1
MD5 63fbc890764584248d658132e882a394
SHA1 b924a70b833b8e62e1cda77f6644edbd89bbf27b
SHA512 54dc3db7fd193ce7f389ae070ec250811fcb9b3628a08bc6bf58358adda806f3b178d9843c4ea7120d7e908f3e5a2b2b1603bdf323f0ddf912c9440b219b629f
TLSH
T12CA0021103C04017E0D325FB365212419704CC241110DB4745D15044CC998408E8100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\94f5f36d-dd83-4973-9273-10c1cc8ba31e\index-dir\the-real-index
Size 72B
SHA256 76f43652e3eea0e351ac1e061c58f3da43bda07854b3519f1e6a955eb23af77b
MD5 e38a9626c1f09c79197a963056806155
SHA1 adab89a901855ad5d9b1a00ffe427f49ff012e9d
SHA512 1765e263b8f9be56d0f3e54aa665016b7b743bbf25e70b1d1344cd7143059f237fc03e77e4a375e5cb7ad5b91fb3b686c42c0b20bb060b27be25c4dc5ef045f4
TLSH
T1BCA0021416C05002C4026FB237D643437364DD1F0312134743924444FE785954EA161E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 21ae190308ecc4368e64c0b31f14f95a999e4d8d4a13f5a168557085b15aee33
MD5 580e09f18667c1bc908a700a70358fc7
SHA1 1e632c4a03d50ec38ccd1770a5b49c76da4a92df
SHA512 f26aba1ac76332cbf1eb0f64d08476a33e22a37a54ecb42f96571f834533adada8fb2a373b17286f8ba6028601774f10acb1037cfb7c2e30775d60f7eb08f24d
TLSH
T116E0C0F72DF36C14ACFBE3D2243084B401023824C884EE8F5815A3C74070764302AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f37d3876eeb831991c9b77e2306391db85874190d2f9383109bed4eb4d3f21cc
MD5 07603f9b01b68894fd547e96d6ad021e
SHA1 83036692102f4ae28a36206ca2b209e27967698a
SHA512 059d6ad298cf45f610e387673a051bda02daddffe1b9c8303d680b462063cc7cec9ead1b483446ef3d8f10a4bced573605c5fdf244aa8cea689f9574cab96326
TLSH
T1F9A00211CA67C049D0400275F1A54A94B211E8D85A063621C0FCD2D8C952140419A055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e402.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e402.TMP
Size 48B
SHA256 dfe647ece6c357fdec55201f83b043e9be1b80d16c8e96bb6c5735606d3b21b6
MD5 26b27dea607be5d3a8f34afaae7f0efa
SHA1 768a533f83a0a21744dc23aa08df6d94ca7c5d9c
SHA512 9ef888e9b5ec820878627c2090cfa799b907c0291fecf1d9a35490e12fa12c4202272a7dacb636ea3dc088e9258717ad997e25750618a5feac40974fbfadd87d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a4c5f95c24a8684c3023cf4cddf41bbfe11d840c20cf7634bb3d721902c5296b
MD5 a92f13f69ab94d79e7b7dc6e0cf588dc
SHA1 7aecd2b2d1aed17ea70a1e58e42756c507b184d7
SHA512 22467ab6828b45ab80b9f548a63415a08abd0e07864450fb5c816845ae85008193f2f909b30583298f9395b916b08e195c869c2957202b7dbd4795513a183c60
SSDEEP 96:K0oQK1Wy2vKKg0uoad84KIkvh8vmnwvKv+nWvLyaXM0kqmsK3qL:ijhZhFnA
TLSH
T1F3C1D11172FA4340397E69188179979B568172E33428F62F3FBC05A68A6BE045CFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5925dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5925dd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d0a2cbd103129bc2528a720df70b1f371d091bc47a4abadb1a0ea6bd2132bce
MD5 ac0b68766571b85f0ea0be9c85db3041
SHA1 482a4c56b80835f75e12de91b96628104852dd55
SHA512 3ab0e1c1a3617d1b6ed8fbc195d7f889f39bf6356119c43b90d683e63bfe448f5fb800a8fa3b81348adcb224860f87e0603b12a21c0cd923e87736c2b2c052fd
SSDEEP 384:4iFyZcIKssNp8TUNTUlIlAOTHO0lapomcBBP2BqpXItxT+rXCYomhrrsa+VYad7N:DFAhywgrlaDAtHBIjuC+hrrhgd8E
TLSH
T1E8C21AF258D7983AD9AE5783B77E2D028DBCC053B5846A50B7D85A0DCC9A1BFC306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6b1fdfaca2fee6685ea10c795c01d48eb9fe6b9556dca9b81617278b9c67595d
MD5 6ad1cbeb499cb020df2e4ad62c98ad59
SHA1 11f8e0c346d5a520f269736a065dbdedbcfc6b50
SHA512 fe00f4600d9c21048042e01f55a1d2031a8f2596a69f408965c2daf7b3dce1d8f5aaf800247aa678ac23116e6e4840d2dde2a03ce5c18a9db3dd5ba01f106e5a
SSDEEP 384:/ZcIisNyAOTHO0lapomxYBP2BqpXItxT+rXCYoPhrrsa+VYad7UxoT:XijlaDutHBIjuCnhrrhgd8E
TLSH
T140926C36AD78AC6A4DE793C1B54736039EB49457A6CC2F90CAEC5B1D04DE29C030AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dca9e2b94ba0ee7dd468652fbb45bfd7d33877332cfdf1787a2ff1eafd7ae1ed
MD5 ff14d4f5c51f8429c3319c62640b3ca1
SHA1 eabd61b50c217ca06e4fd6eed72252da9f70982f
SHA512 f059b73d4d088eaf712cee0eee11c0f76c1090587ee6e808a8951206be357afd42c16d1979c852c1aa72f3f26f63052c1128bf94e6daea622cefb50e36ad73c3
SSDEEP 192:0ONn64AeQmiUyUF8AMqqpXIP10Ajzou+6htysqU6:0ONn6na3FfMqqpXItxT+NPU6
TLSH
T13D02DA35B8786C6F8DF3AE85748736139FD42027FA952F90DAE81B1D10DB64C2306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 66902e6fb9ace27a609c5a11461ccfdf7e334d1ac442d3d06aa24c68b2498c29
MD5 ca624b6154d8f12909f1bc71951bd814
SHA1 d8cd9626f0ec334edcf51378c2d1d7b4a5a2e47e
SHA512 2536a593235342436cbc4e2d9d88fc414c692f2c2f2a0fedc3f2550124590c8519bd324c7569723ceb02ef04622c47a4249a1eb2f34e6615e3f8e85f941c3140
SSDEEP 384:yZcImsNyAXTHO0lapzbmx0BP2BqpXItxT+rXCYo1hrrsa+VYad7UxoT:Am0la5K2tHBIjuC9hrrhgd8E
TLSH
T12E826D36AD78AC7A5DE793C1F54736039EB45467A6C82F908AEC5B1D00DE29C030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8fd369cff5723173a393201b9d4e8e1c929d2d2aecb2d673d802ee2f37883ea7
MD5 c085ceccc4ccdd80c6013ed97e316c1c
SHA1 366e0aa85eb7a73bc5b529de18fee8afdac32b73
SHA512 77a45262be9ec469ed188430bdc7385f894a8d603a1397afbe33fd8eeeb803abc36057bbbf5eed4b0133c8519f9d9be2223d9e3f204758ce692aa5d394654443
SSDEEP 192:0ONr64AeQmiUyUFqAMqqpXIP10Ajzou+6SXUHPwo8oxhhD//rU6:0ONr6na3FJMqqpXItxT+rXCYohhrrU6
TLSH
T186121C35A878AC6F5DE3A6C5B08735135E955127EA897F90CAEC1B1C01DF25C130ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 75c48f6c7f2a62ce4e2581f676c7fecda7678bb0e5c517af33a9acdb2e525089
MD5 a6fb4af16591b3c94bae6c1bd2888ce6
SHA1 2bb78decade553c1f832a63fc1c328e69a2d45d7
SHA512 77c1560ea388024d13aa582d1fee604177cf53cab91bafa9aa2a97a752d69074e122d8710d230c73895bd9a524746f0b01c1c61e6e755e7a65e1786d1cc05762
SSDEEP 384:2ZcI/sNykVUO0lapPmxJBuBqpXItxT+rXCYo1hrrsa+VYad7UxoT:k/NlaYrZBIjuC9hrrhgd8E
TLSH
T192827D32AD78AC6A4DE793C1B54736039EB89467A6C86F908AEC5B1D00DE29C030AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a56dde5547183ead708b2d84c1ff72245a213860c794b969b2fd19e6350a8462
MD5 3f6f02201c1c22274622a40f55d05167
SHA1 895eff0289f9c6bd4620a796f2835f20ed282354
SHA512 a3463d0ee72eceaf22ee7bb24233b8038c88acc6a486719cc7b6633e71463b5e101c4d8df79400b4c7af7e1b7ece451d09493741c00b6a4d518de4b52d890750
SSDEEP 384:4iFIZcIK2sNp8TUNTUlIlAOTHO0lapz1mcdBP2BqpXItxT+rXCYouhrrsa+VYadh:DF2fywgrladYstHBIjuC2hrrhgd8E
TLSH
T148C21AF258D7983AD9AE5783B77E2D028DBCC053B5846A50B7985A0DCC9A1BFC306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8a0367702770fe1465e4e2662b5458116ef7bc56944105fd7ac82b3cddd5246e
MD5 4420947f38ed021c19b018c6d26f467b
SHA1 c341555d256db15414ef58d1f42250548127195d
SHA512 343d720afd815240c167cf88560236f074aae54accfbc58b5d2f8e0d6ef8b61bc6fc43247a8a353fc99e6d3916311b33846389410f25cdaee3026607d502a088
SSDEEP 384:4iFTZcIK/sNp8TUNTUlIlAOTHO0lapTmcdBP2BqpXItxT+rXCYoshrrsa+VYad7N:DFL+ywgrlaAstHBIjuCUhrrhgd8E
TLSH
T16EC22AF258D7983AD9AE5783B77E2D028DBCC053B5846A50B7985A0CCC9A1BFC306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ffa69b60dab8dbc3ae0e2d08c96d5f71cd70d2c22e7671030049d51298439cb8
MD5 502f90c80f7b8e9a2dbb8727c680e53f
SHA1 444ef17d23dffcb98a565f632eadbb6989fdbe73
SHA512 273a25346edda7696c1af91729f479da7fed1bc818a8e26c1a7319eca57fb4441cade3f065b2c6cdc2f40fc1ff06ef7f3329105a3750bde6af883bf218961907
SSDEEP 384:4iFpZcIKEsNa8TUNTUlIRAOTwO0lapLmcdBP2BqpXItxT+rXCYoqhrrsa+VYad7N:DFhlHwgSlaostHBIjuCChrrhgd8E
TLSH
T132C22AF258D7983AD9AE5783B77E3D028DBCC053B5846A50B7985A0CCC9A1BFC306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a56e273530b5e26815603c4298c050b311059bff995572a28dca5a5738cdfd0a
MD5 82f39c144bc9f1c4460a0e41a40b0d84
SHA1 983bdf92a6967499b3029934bd012a64c9efaf63
SHA512 617fc6a0eae3185f36f6d39b2a0d6897b54f3b087d54298335d900a9ce1cbfa2fad69683cefc42a4d83568a153c6a5b2f9d1ac569e7bfd656b4e2b20d620ff39
SSDEEP 384:4iFPZcIKcsNK8TUNTUlIlAOTHO0lapomcYBP2BqpXItxT+rXCYoShrrsa+VYad7N:DFHBnwgrlaDptHBIjuC6hrrhgd8E
TLSH
T12AC21AF258D7983AD9AE5783B77E2D028DBCC053B5846A50B7D85A0DCC9A1BFC306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1e67163f99f744347834d425e06e6bf65af641e9ab72d8bdfca75aea66f821ba
MD5 d4ccd34ae05f8ad7a7bf8f16c4e3116d
SHA1 f57d289e7ca0842c4d50088bf2450ef316fdad83
SHA512 07a35c223dd4544606d72ce94cc5f3fe993cacd2f552604c94a1e0bc18808dbf99b5c9c6df0eb69f2c3e9f9760c616f0ea333fa7f32c7c5c2c8a93571ec408bb
TLSH
T13DE00200D645047FC17C037400C727347AB1551013E30255525061B538613142B309C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 08ace6002ebc47851e47072e572dfa729ad8a8743fba8715871dee442fa4cf6c
MD5 d5f3b4c58df3c9099ab3c62105f0b74c
SHA1 766c9ddb41db58b640a6d7608343574ac1014a3e
SHA512 50cd77698d6f80043c100b46251e965e115372285b5e024dda5d9f1b3ca4a658e27ebda2e8d3ee0ddf02421c78b32e7e6384e3c71fe72d460897cd8a015fada0
TLSH
T1E3E00400D545007FC17C037400C7303471F1451003F30354504071F134413140730DC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59e93d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59e93d.TMP
Size 392B
SHA256 24996acbae39a6144fe6559765329b3282405f1557812f3c8b4d9979c00c0943
MD5 b130ade79cba334bbbbfe9653c38363a
SHA1 1f9d305e1f1c70e441a6481dbc451115a16eb29a
SHA512 cee71a0ae3ea82ed76887218826799a719946f873d9386b4805cde0e6d4a66bb8fe54320f58a499e67ce1fc5ba5b37e03c305256311ceecc92a725ac38c4904c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0951f4e954c616fed7a8224131d948653a88d3c0b07d03f0b3d8f9fb1d04a55b
MD5 3ede5eb130c30959ab56ac5f03ebe39b
SHA1 4a009717d26f1f0c4587a7da03cd85531af0bbbd
SHA512 7e075196e9a6959454bd8bd2dc2a6ca69e82499bfb1dfcf97f33ea9ac694578d80c3c2d9b36991daadf1a3d848036d9d402b4e43ef400cb3e99af833381eaf8c
TLSH
T11041295CA7F91118B3B76E5AABF6A86D847EBD332E0B949D00110D4E0622F40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 9d0b561e13d08b9a277bcb59b48a9a098ba7b6b0ddbde518c85a3a2aac024bfe
MD5 1cb23f562902956681f291ccc5a0dc32
SHA1 99718271e27cb824326e887756b9ac4465772b02
SHA512 387fdcb64b3430eacc543fa20fd161d1582ef8ced73b1c88cd93849d4b175e5199db4e117241dd8ecf8a91c1f0e67078b63256d5b41a8c8e81a39502b8557cd7
SSDEEP 96:BRXVE2y2C1uiy4X/GDvOH9ixso6T3arEOVrFR18:BRlE2y/1/y4Ua9ixs1TMtVrDW
TLSH
T14BD2B456F808E642ED4A2C32AFEBDAEC32717E12DC2A035375C1B77E49BB4C04D58599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024_000_DotNetHost.log
Size 4KB
SHA256 3bcac46c294a6241bcbe22e79ec0493680b2ba0868d420d3270de5d73d35749f
MD5 6db10eb82a1f07604be3749bf89e1195
SHA1 5df1557aeca98d70282f5b485b9c9c6acca72312
SHA512 d3fdeef3c1ae3a892e737ca6fb40005fef1ec7e08c471651f7e59dd3e6ae299fde0a2e3ad9ed666be9b083f12075d4ec2457f860376744524631726d1d2989f4
SSDEEP 96:Y0+rlYc8pOqFLyGfVH+ic8yHT2972xL2Ec8r2El2/423KFMp2G:JpOqFLywHAHT2J292O2U2Q23KF42G
TLSH
T1E9813A591EF50945B5B3564BDEF3D0126A33BDC36835DF4C2285431A42AF806A8BCBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024_001_DotNetHostFxr.log
Size 2KB
SHA256 7e0332b45a2ba438f2050a3fd0f3b2d9011cac2d2fe8b703cf1e6d5a5b8fb16a
MD5 32e142bf8ca5e5e93313461636ca0900
SHA1 6e86471f8501212aac5a5fec7cc6b260385415a6
SHA512 c2b2c34811cb69f021c5f89a25b5fdd0d06c19b2988f3fd8cf20c747b4aac487a6c533b2966e689e93c2d6f5f63a9210a1890e95292a7b0871b0e8001a56363b
TLSH
T11E4103581BF50945F6B6574B9AF3D0539A33FCD26835CF4C2286831A066B9046CACFBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260912165024_002_DotNetRuntime.log
Size 2KB
SHA256 cd83b302e364cd389674cfff28ab1c0c3e80f000eeba313e4eb8fc6cb6f794ee
MD5 31536bee5a81bc0a399f933fa50480db
SHA1 a997bdb31ec5a40737c7df9594807b28013f0ad9
SHA512 2bf469c46c1397392f9026ca2880024690bff267decb3ee9c05eef248ad6019debceebaf3d9cf6d148f6d490b430f00eb6280a68bd0e8afd627f04a71412105a
TLSH
T13241275A1EF4094AF6F7974B9AF3C0525A33FC976835CF4C22854219066BD006CBCB7A
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\DotNetHost
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\DotNetHostFxr
Size 920KB
SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
MD5 0dbebff80e13ff5ab5de800e763e5b37
SHA1 e044e032e89bbdededce81d655ae84e3123d367d
SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
TLSH
T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\DotNetRuntime
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
MD5 6712931c838d7173b4fe90e26cf3b44a
SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
TLSH
T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 d601bf58e8cea1665e4aaf2cc8c085e9423267042f2b6f61640aa39a3057f32d
MD5 b99d4de4633816077fe8b7e027a7204c
SHA1 98324727ba0cf918a9e539155be2ed9fcb0e3bf0
SHA512 2d43bc8935071c377a70b11e19d19b107005d2ae3600f300db8bfb68e7deb917af89ec83b809b56b44b9ef785897ad21ce4716d9cbcdb68f033e8b7e4da55f96
SSDEEP 96:euJe84gMnowVvgMngAJPQoR8uws80+OJruciTJnIuG:bPvMkMLaobP54BI/
TLSH
T1F202EB402BE52626F3B79E72A9B26700AF76F912AE18CF4D108081091C72F55DE79F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7A23.tmp

Path C:\Windows\Installer\MSI7A23.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{8B34CE9C-75A7-4E07-9FA6-E75AA2FAFD53}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2548-1490-0x0000028A9D020000-0x0000028A9D021000-memory.dmp

Download

memory/2548-1492-0x0000028A9D130000-0x0000028A9D140000-memory.dmp

Download